search

aio-libs / aiohttp-security

auth and permissions for aiohttp
Apache License 2.0
229 stars 68 forks source link

Should identity be changed? #575

Closed yanxurui closed 1 year ago

yanxurui commented 1 year ago

I am using this module to implement something like 'remember me'. I understand that we should use a random string such as a uuid or hash as identity to make it unguessable for attackers. My question is is it fine to use a identity that is immutable for a specific user? If so, what if the token is identity is leaked? If not, when should it be changed? Thanks in advance!

Dreamsorcerer commented 1 year ago

I'm going to make this a duplicate of #313.

I'm still a little unclear what the rationale of this is. The demos don't follow the documentation advice, and I'm just not clear why it would be an issue to reveal the username or similar. (If you use the session backend, then you don't even reveal it, the session is encrypted).