search

ScarletStudies / docs

documentation for scarlet studies project
0 stars 0 forks source link

improve jwt in emails #25

Open tristanmkernan opened 6 years ago

tristanmkernan commented 6 years ago

currently, jwt does not expire. is this ok?

tristanmkernan commented 6 years ago

this is a critical bug, it allows arbitrary account takeover. consider:

  1. bad guy makes a million accounts
  2. bad guy deletes accounts
  3. innocnet users make accounts
  4. now bad guy can login as anyone

potential solution: instead of user_id, base tokens off email. not such a problem because we are emailing them the token anyway.

tristanmkernan commented 6 years ago