search

Aidan275 / nativeqda-dev

NativeQDA
http://dev.nativeqda.xyz/
GNU General Public License v3.0
2 stars 0 forks source link

JWT payload becoming invalid #20

Closed Lucas-W closed 6 years ago

Lucas-W commented 6 years ago

For example if you change your info (eg. Email) on one device and return to another with a JWT containing the old email.

Possible solution is checking the JWT's iat (Issued at date) field to a 'lastmodified' field on the user model and if it's greater than, either send a new JWT or require a new log in.

Aidan275 commented 6 years ago

Should be resolved in commit c61031f.

The implementation could probably be more elegant so feel free to improve.

Will need more testing but looks good so far.

Aidan275 commented 6 years ago

Bug fixes in 6d3b90e.

Due to the new lastModified field in the User model the users in local databases may need to be re-added.

Aidan275 commented 6 years ago

Appears to be working in Firefox 54.0.1 (64-bit) and Google Chrome 59.0.3071.115.

Small bug in Internet Explorer 11.1007.10586.0 and Microsoft Edge 25.10586.672.0 where the out dated token message only appears after a refresh, not after page navigation.

Not worth looking into until later.