atomicdata-dev / atomic-data-docs

Atomic Data is a specification to make it easier to exchange data.
https://docs.atomicdata.dev
MIT License
17 stars 7 forks source link

Token based (OIDC + JWT?) based authentication #87

Closed joepio closed 2 years ago

joepio commented 2 years ago

I designed a custom authentication protocol for Atomic Data. It's a simple system, and it gives people a great amount of control over their online identities, but it has limitations:

So how should tokens work? Let's consider a few approaches:

OpenID Connect, OAuth, JWT

The standard stack for authentication, used everywhere.

Just JWT + /getToken Endpoint

  1. User sends an authenticated HTTP request to /getToken.
  2. Server responds with a token, which is valid for some time (maybe later add an optional expiration query param). This token should probably be a JWT.
  3. This token can then be sent using an HTTP header like so:Authorization: Bearer eyJhbGciOiJIUzI1NiIXVCJ9TJV...r7E20RMHrHDcEfxjoYZgeFONFh7HgQ

Client-side signed tokens

Considerations:

joepio commented 2 years ago

We now allow client-signed tokens in cookies, which solves the most important part of the problem: only signing one thing every few moments.