# Authentication token in the attachment link in a card getting stale

**URL:** <https://community.taiga.io/t/authentication-token-in-the-attachment-link-in-a-card-getting-stale/3249>\
**Category:** Troubleshooting\
**Created:** [May 2, 2024, 11:34pm UTC](https://community.taiga.io/t/authentication-token-in-the-attachment-link-in-a-card-getting-stale/3249 "2024-05-02T23:34:02Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![yannbourdeau](https://dub1.discourse-cdn.com/flex017/user_avatar/community.taiga.io/yannbourdeau/32/2309_2.png) [@yannbourdeau](https://community.taiga.io/u/yannbourdeau)\
**Post date:** [May 2, 2024, 11:34pm UTC](https://community.taiga.io/t/authentication-token-in-the-attachment-link-in-a-card-getting-stale/3249/1 "2024-05-02T23:34:02Z")

</div>

I’m self hosting a taiga instance for the punk zine Razorcake and it have around 100 users on eight kaban boards. These users are not proficient with computers.

Two users complained they got an error (no permission) trying to download attachment. The only way I figured out how this happening is by staying inactive on a card page (I don’t know the lifespan of the token, I tried one hour) and trying to download without refreshing the page. I have reproduced the issue on all browsers on Windows and Safari for Mac(Strangely Safari download something but the downloaded file is garbage).

I have look at the HTML page and saw the attachment links contains the token. I don’t know the lifespan of the token. So I have deduced the lifespan of the token is less than an hour, the user was not doing anything on Taiga and stay on a card page for at least one hour and, finally, try to download an attachment. The user is still logged in Taiga. If he refresh the page then everything is working.

For me it seems to be a design flaw and not easy to fix. I don’t know if it is possible to do a wrapper in javascript on the link to refresh or get a new token while the users is still logged in Taiga.

For now, we are telling the users to refresh the page if they got this error.

Anyon has any comment on this?

---

<div class="post-metadata">

**Author:** ![Charlie](https://avatars.discourse-cdn.com/v4/letter/c/d6d6ee/32.png) [@Charlie](https://community.taiga.io/u/Charlie)\
**Post date:** [May 6, 2024, 6:59am UTC](https://community.taiga.io/t/authentication-token-in-the-attachment-link-in-a-card-getting-stale/3249/2 "2024-05-06T06:59:57Z")

</div>

Hi there,

If you installed using docker, there is an [environment variable](https://github.com/taigaio/taiga-docker/blob/main/.env#L33) called `ATTACHMENTS_MAX_AGE`. That sets the time, in seconds, that a token is valid before the server refreshes it.

If you installed from source, the `taiga-protected` folder should have a `.env` file with a `MAX_AGE` variable. It works the same.

After changing the value, restart your services or recreate the containers.

Hope this helps,

Best regards!