search

AlekEagle / sharex-vue

The official Cumulonimbus server.
https://alekeagle.me
13 stars 2 forks source link

Fix ESLint issues/warnings and improve security. #11

Closed cstanze closed 3 weeks ago

cstanze commented 3 years ago

So essentially, I just moved everything from the current token system to the TimestampSigner from reallydangerous which is a port of itsdangerous from Python for Node. It's easier to manage and can hopefully increase security alongside the improvements from bcrypt to argon2. There may need to be a wave of password resets for a migration from bcrypt to argon2. If this isn't favorable, it is very easy to revert the argon2 changes. As a final note, I might have broken sessions slightly with the change in tokens. This would need to be tested first before I can confirm that I broke anything with sessions. I hope these changes can be implemented to increase security. To send off, I wish you a good day.

AlekEagle commented 3 years ago

I'll test when I get home

AlekEagle commented 3 years ago

I liked my eslinter options smfh

cstanze commented 3 years ago

Oh also the tokens have to be regenerated... 👀

AlekEagle commented 3 years ago

that's what happened when i pushed my initial sessions