Adding additional values into the /info endpoint

[MarekNieslanik]

Hi,
this isn’t an issue, but rather a question.
Would it be possible to add some additional information to the /info endpoint?
Mainly the value of /http_server/authentication/basic/timeout_in_seconds. I’m trying to implement automatic token refreshes in our Python HTTP API client, and this would be really useful.
I’m solving an issue where the token expires and the API returns a 401 Unauthorized so the client need to reauthenticate. This is a bit problematic when uploading files in parallel using 5 workers. I would like to implement functionality that controls the session expiration and refreshes it on its own, so there wouldn’t be any try except. For that reason, I would need the timeout_in_seconds value, so the solution would be generic for every configuration.

Thanks

[trel]

That seems reasonable.

The /info endpoint must strike a balance between being useful and giving too much away and cause security headaches.

I don't think timeout_in_seconds poses any real concern.

[korydraughn]

Agreed.

We are currently working on extending the token's lifetime on each use. This would work just like session in traditional web applications. The feature would be limited to basic/native authentication.

That PR is here: #447

If the timeout value is exposed (which seems ok on first thought), we'd need to consider how that plays with OIDC. Specifically, whether we should expose it or adjust the value. Its presence could lead to confusion.