search

DavidMStraub / gramps-webapp

Genealogical progressive web app based on Gramps
GNU General Public License v3.0
18 stars 4 forks source link

Disable JWT when no password is set #25

Closed DavidMStraub closed 4 years ago

DavidMStraub commented 4 years ago

At the moment, the JWT authentication is used even for an empty password. This is problematic because a refresh token obtained while the password is empty would grant eternal access even when the password is set to something non-empty (unless the secret is changed).

To mitigate this, without having to change the frontend code, the login endpoint should return an empty but long-lived access token. Once the password is changed to something non-empty, this will block access.

DavidMStraub commented 4 years ago

This turned out to be even simpler. A trivial secret key is now used in case of an empty password, such that the key can never be (accidentally) left the same after switching to a non-empty password.