Migrate default server-side tokens from JWT to stored tokens #419

New issue

Closed

opened 2024-07-25 23:38:21 +02:00 by blacklight · 0 comments

blacklight commented

2024-07-25 23:38:21 +02:00

Owner

The JWT mechanism is relatively brittle.

Since the JWT isn't stored on the server, it needs to carry the authentication info of the user, be decrypted as JSON on the server when a request is received, and then undergo a normal authenticate(user, pwd) flow.

This is problematic for three reasons:

If the user password changes, all of their JWT tokens will be invalidated.
It bypasses any configured 2FA mechanisms.
It doesn't provide granular control to invalidate only some sessions - the only way to invalidate a session is to change the password, and that invalidates all the tokens.

Platypush should instead rely on random stored session tokens for this job.

The tokens' bcrypt hashes should then be stored on the application db.

The JWT mechanism is relatively brittle. Since the JWT isn't stored on the server, it needs to carry the authentication info of the user, be decrypted as JSON on the server when a request is received, and then undergo a normal `authenticate(user, pwd)` flow. This is problematic for three reasons: 1. If the user password changes, all of their JWT tokens will be invalidated. 2. It bypasses any configured 2FA mechanisms. 3. It doesn't provide granular control to invalidate only some sessions - the only way to invalidate a session is to change the password, and that invalidates all the tokens. Platypush should instead rely on random stored session tokens for this job. The tokens' bcrypt hashes should then be stored on the application db.