[webflow to gatsby] Best way to secure user sessions blog #196
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
✅ Deploy Preview for gracious-clarke-e6b312 ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
jscyo
requested changes
Oct 4, 2023
|
|
||
| The critical auth token is perpetually exposed over two attack surfaces, the frontend, and the backend and occasionally exposed over transit. | ||
|
|
||
| *Effect of stolen auth tokens:* |
There was a problem hiding this comment.
Suggested change
| *Effect of stolen auth tokens:* | |
| *Effect of stolen auth tokens:* | |
|
|
||
| Refresh token stolen: Detection of theft will enable the stolen refresh token to be invalidated, limiting the damage to a short period of time | ||
|
|
||
| *Detection of theft:* |
There was a problem hiding this comment.
Suggested change
| *Detection of theft:* | |
| *Detection of theft:* | |
| - If both, the victim and the attacker, use RT0 at the same time, then one would get (RT1, AT1), and the other (RT2, AT2). The next request by either of them with the new access token would either invalidate RT1 or RT2, resulting in either the victim or the attacker to be eventually[[1]](#footnotes) logged out. Again, here the backend would get a clear indication of theft. | ||
|
|
||
|
|
||
| *Once detected:* |
There was a problem hiding this comment.
Suggested change
| *Once detected:* | |
| *Once detected:* | |
Chakravarthy7102
changed the base branch from
master
to
blog/express-session-vs-supertokens
…rtokens/blog into blog/revoking-access
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Related Issue
adds Best way ti secure user sessions blog
Link to Google Doc
TODO
Checklist
Remaining TODOs