Token expiration tolerance should be configurable

[CSEMike]

The expiryDelta used to calculate token validity is fixed at 10 seconds.
https://github.com/golang/oauth2/blob/master/token.go#L21

This issue tracks making this value configurable. Why? To support scenarios where the token may be not be used until >10s in the future.

Token validity is used to refresh cached values, e.g.,
https://github.com/golang/oauth2/blob/master/oauth2.go#L260

An alternative API would be to support invalidation of the token cache. But, in either case, a way to configure the max acceptable age of a token is necessary to avoid corner cases when expiration is near.

[narqo]

👍 for the issue.

My usecase is to force refresh stored tokens and I need to have custom expiryDelta.

Another possible solution might be to expose tokenRefresher, so one would have much more control over the refreshment process.

[fharding1]

I've opened a PR that would accommodate this issue here: #396

[andig]

Going through the commits it seems we could already do this with 1e7f329.

[andig]

That said: looks like this issue could be closed @CSEMike

[seankhliao]

Out of scope, use your own tokensource.