# Extending NONCE timeout period

**URL:** https://meta.discourse.org/t/extending-nonce-timeout-period/63733
**Category:** SSO
**Created:** [2017年六月1日 13:24 UTC](https://meta.discourse.org/t/extending-nonce-timeout-period/63733 "2017-06-01T13:24:46Z")
**Posts on this page:** 1
**Showing post:** 6

<div class="post-metadata">

### Author: ![cmckulka](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/cmckulka/32/124474_2.png) [@cmckulka](https://meta.discourse.org/u/cmckulka)
#### Post date: [2019年三月19日 06:05 UTC](https://meta.discourse.org/t/extending-nonce-timeout-period/63733/6 "2019-03-19T06:05:19Z")

</div>

I have no experience with Discourse plug-ins so I’m guessing a bit here …

Is the potential solution that the NONCE expiration that is currently hardcoded to `10.minutes` in `single_sign_on.rb` (see [file on git](https://github.com/discourse/discourse/blob/master/lib/single_sign_on.rb) for others reading this) could be overridden by a plug-in?

If so, reading [this topic](https://meta.discourse.org/t/beginners-guide-to-creating-discourse-plugins-part-3-custom-settings/31115) it appears that would be pretty trivial. Just changes to the following three plug in files - `config/settings.yml`, `config/locales/server.en.yml`, and `plugin.rb`.

If I chose to not surface this in the admin UI (I likely would), could I just provide the updated value in  
`plugin.rb`?

Chris

---

_[View the full topic](https://meta.discourse.org/t/extending-nonce-timeout-period/63733)._