Session mechanism - Githubissues

FranckKe / mersea

Web app to manage and visualise geolocalized waste report

https://oceanplastictracker.com

MIT License

16 stars 5 forks source link

Session mechanism #349

Open mdouchement opened 3 years ago

mdouchement commented 3 years ago

Currently JWT tokens with revoke strategy is used but there is no refresh of this token. We should move to a Session mechanism:

access_token that expires after 30 days (must be configurable)
- Provided in the Authorization header in PASETO format
refresh_token that expires after 1 year (must be configurable)
All session must be stored in database like app/models/access_token.rb