Comments (4)
The getDBURL
API injects the session token and a randomly generated password into the database URL. The user's login information is not sent. When the session is closed this will no longer work. Regardless, any production system that is not behind SSL is insecure.
from superlogin.
Thanks for your response Colin. I looked into the code for getDBUrl and it seems to simply append URI encoded dbServer.user
and dbServer.password
from the configuration settings. Could you please point me to the code where it generates and uses random password for getDBUrl
?
Here's what it looks to me ->
In dbAuth/index.js/this.authorizeUserSessions -
var db = new PouchDB(util.getDBURL(config.getItem('dbServer')) + '/' + personalDB);
And then in util.getDBURL -
url = db.protocol + encodeURIComponent(db.user) + ':' + encodeURIComponent(db.password) + '@' + db.host;
Am I looking at the wrong method?
from superlogin.
See here for the code that generates this. Username and password are a URL Safe UUID.
from superlogin.
Thanks Colin, I am closing this issue.
from superlogin.
Related Issues (20)
- How can I remove confirmPassword requirement?
- Validation failed HOT 8
- Validation failed HOT 1
- Calling /auth/session with authorization header is returning unauthorized HOT 1
- Use template-literal instead of EJS
- user-db-added event doesn't get emitted HOT 1
- New release? HOT 13
- Validation Failed HOT 1
- Register vaildation failed HOT 18
- Mandatory Migration from Cloudant to BlueMix not compatible with Superlogin HOT 1
- Superlogin with CouchDB crypto.pbkdf2 "digest" argument required HOT 1
- how to add profile data with registration?
- removeUser not working
- Live demo isn't working HOT 1
- Forgot Password function
- TypeError: Cannot read property 'valid' of undefined at Function.PouchDB.parseAdapter
- Howto: use superlogin with current nodejs HOT 6
- Set a Doc create limit per user
- super login spaming console with errors
- Graphql
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from superlogin.