Restore previous JWT tokens generation logic #237

New Issue

Closed

opened 2022-12-16 23:19:12 +01:00 by blacklight · 0 comments

blacklight commented

2022-12-16 23:19:12 +01:00

Owner

In the previous implementation of the JWT generation logic the service's private key was used to encrypt the authentication payload (without the password), and the public key was used to decode it.

The new logic (using Python's native rsa module instead of cryptography) uses instead the service's public key to encrypt the payload (including the password) and the private key to decrypt it. The decoded password is then used to authenticate the user.

We want to go back to the previous logic for two reasons:

Encrypting the user's password in a JWT token is not particularly safe, even if only the service can decrypt it using its private key.
If users change their passwords, their JWT tokens will be invalidated.

In the previous implementation of the JWT generation logic the service's private key was used to encrypt the authentication payload (without the password), and the public key was used to decode it. The new logic (using Python's native `rsa` module instead of `cryptography`) uses instead the service's public key to encrypt the payload (including the password) and the private key to decrypt it. The decoded password is then used to authenticate the user. We want to go back to the previous logic for two reasons: 1. Encrypting the user's password in a JWT token is not particularly safe, even if only the service can decrypt it using its private key. 2. If users change their passwords, their JWT tokens will be invalidated.