Cookie/Header based authentication of userDBs about superlogin HOT 4 CLOSED

The getDBURL API injects the session token and a randomly generated password into the database URL. The user's login information is not sent. When the session is closed this will no longer work. Regardless, any production system that is not behind SSL is insecure.

from superlogin.

Thanks for your response Colin. I looked into the code for getDBUrl and it seems to simply append URI encoded dbServer.user and dbServer.password from the configuration settings. Could you please point me to the code where it generates and uses random password for getDBUrl?
Here's what it looks to me ->
In dbAuth/index.js/this.authorizeUserSessions -
var db = new PouchDB(util.getDBURL(config.getItem('dbServer')) + '/' + personalDB);
And then in util.getDBURL -
url = db.protocol + encodeURIComponent(db.user) + ':' + encodeURIComponent(db.password) + '@' + db.host;
Am I looking at the wrong method?

from superlogin.

See here for the code that generates this. Username and password are a URL Safe UUID.

from superlogin.

Thanks Colin, I am closing this issue.

from superlogin.