Comments (6)
There probably needs to be a distinction between different types of tokens. Short lived tokens probably don't need to be encrypted since the risk of a database dump having damage is low (tokens with a lifetime of a hour etc)
Long-lived tokens (especially refresh tokens) should probably be stored properly - this means not SHA256 since it would be (relatively) easy to crack etc
from auth.
Looks pretty good to me!
from auth.
I wonder if we should hash the token instead? It should be fairly easy to just store the SHA256 digest and compare that instead of the token itself. It would be a bit harder if we wanted to use BCrypt, since we'd need a second field to lookup the token for verification. But I think SHA is the better digest algorithm here anyway since you want token lookup to be relatively quick.
from auth.
Oh yeah good point, I think that’s the way to go. Shouldn’t be much of a speed difference either.
from auth.
Long-lived tokens (especially refresh tokens) should probably be stored properly - this means not SHA256 since it would be (relatively) easy to crack etc
SHA256 should be fine if the tokens are randomly generated string of sufficient length (say, 192 or 256 bits). Salting is only required to generate additional entropy, which is already provided by the full token being random. And BCrypt is only needed to make attacks on a small-ish solution set infeasible; brute-forcing 2^256 possible values is of course intractable even without BCrypt. See e.g. https://security.stackexchange.com/a/122855/177736.
from auth.
How does this look for now? Just to get something into my project without requiring breaking changes:
extension Token: BearerAuthenticatable, Authentication.Token {
func willCreate(on conn: MySQLConnection) throws -> EventLoopFuture<Token> {
token = try SHA256.hash(token).base64EncodedString()
return conn.future(self)
}
static func authenticate(using bearer: BearerAuthorization, on connection: DatabaseConnectable) -> Future<Token?> {
guard let hashed = try? SHA256.hash(bearer.token).base64EncodedString() else {
return connection.future(error: Abort(.internalServerError))
}
return Token.query(on: connection).filter(tokenKey == hashed).first()
}
static var userIDKey: WritableKeyPath<Token, Int> {
return \Token.user_id
}
static var tokenKey: WritableKeyPath<Token, String> {
return \Token.token
}
typealias UserType = User
}
from auth.
Related Issues (20)
- Conforming Fluent models to BasicAuthenticable when username/password types are optional (i.e. String?) HOT 4
- Can not generate Xcode project HOT 2
- Protected routes can still be hit after calling `unauthenticate(_:)` HOT 4
- Should AuthenticationCache be public? HOT 2
- Stable release? HOT 3
- Route using SQLite model and SessionMiddleware timeouts when ran on ubuntu. HOT 4
- unauthenticate() should remove session when using authSessionsMiddleware
- consider including JWT by default HOT 5
- web session cookie expired on login HOT 1
- Would it be possible to avoid depending on the Vapor package?
- Unable to remove sessions with AuthenticationSessionsMiddleware enabled HOT 3
- Problem with Auth 2.0.2 HOT 2
- /Sources/Authentication/Persist/SessionAuthenticatable.swift:44:19: error: value of type 'Request' has no member 'hasSession'; did you mean 'session'? HOT 2
- Remove reliance on DatabaseKit/Fluent HOT 4
- `AuthenticationSessionsMiddleware` should use a connection pool HOT 10
- Request has no member 'hasSession' HOT 9
- Using token and session auth should not run both HOT 9
- Auth doesn't finish build with vapor 4 HOT 1
- BasicAuthenticatable for non-final classes HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from auth.