Ask HN: What do you use for authentication and authorization?

Re:Ask HN: What do you use for authentication and authorizat... by jakelazaroff on Thursday December 27, 2018 @02:30AM (#18768056)

"No revocation" is a dangerous constraint to have in an authentication session. What happens if a user's token is compromised? You have to either wait for the token to expire (if you implemented expiry) or log out every single user.

[ Parent | on HN ]

Re:Ask HN: What do you use for authentication and authorizat... by CorvusCrypto on Thursday December 27, 2018 @02:43AM (#18768104)

That's exactly the trade-off. I'm not going to say it's a big enough negative to dismiss using the stateless signed token scheme because it depends on the needs of the application.

But either way, if you really can't afford a database or cache layer lookup to see if a token is still valid, then you accept that by using a bearer token, that is only validated by signature alone, that it is possible a user will have their session hijacked without possibility of revokation.

The usual way this is mitigated is by use of a small expiry time (I've commonly seen <=5 min) and a revokable refresh token. This still gives a hijacker a possible 5 minutes (assuming 5 minute expiry) if a user revoked the refresh token, but it does mitigate the damage while still reducing DB lookups since you only do a lookup in token refresh. Hope that clears things up. Again your application needs should drive these decisions.

[ Parent | on HN ]

Re:Ask HN: What do you use for authentication and authorizat... by tyldum on Thursday December 27, 2018 @02:57AM (#18768150)

Indeed. However, this is just a building block and not a library solution. Combined with a revocation list you are good. And use something like OpenPolicyAgent to implement it, adding a lot of other possibilities as well.

[ Parent | on HN ]