search

HemmeligOrg / Hemmelig.app

Keep your sensitive information out of chat logs, emails, and more with encrypted secrets.
https://hemmelig.app
MIT License
697 stars 61 forks source link

No token refreshing #226

Closed m4-droid closed 9 months ago

m4-droid commented 1 year ago

Description

I am not sure if this is a valid issue or not, but if token expires while user is using the website then they loose the access to /account I think there should be some token refreshing. and also when this happens the upload files button still works but the create secret does not work.

Screenshots

No response

Additional information

No response

bjarneo commented 1 year ago

This is valid. Not been added yet, and it is really needed. Let us keep this issue open.

m4-droid commented 1 year ago

I was thinking of adding a check in preValidation if the token is about to expire then issue new one, but since there is no access to any api with preValidation on home page this approach might not work there and only the presence of public token is changing the state to loggedin so if token expires or someone explicitly deletes it, they will still be loggedin as long as public token is there (username)

bjarneo commented 1 year ago

I am also looking into changing the entire setup for tokens. I.e. Change it to use sessions and not JWT. Not quite sure yet.

bjarneo commented 9 months ago

https://github.com/HemmeligOrg/Hemmelig.app/pull/250/files

temp solution