Consider Valet Authentication module which is used for limited proxy access like public/customer initiation sites

azist / azos

A to Z Sky Operating System / Microservice Chassis Framework

MIT License

213 stars 29 forks source link

Consider Valet Authentication module which is used for limited proxy access like public/customer initiation sites #911

Closed itadapter closed 3 weeks ago

itadapter commented 8 months ago

Issue Valet keys
Filter to selectively apply ONLY to specific API routes
Probably make it a module IValetProvider like IOAuth under sec/services
Use Proof of work on the client (e.g. client-side KDF)
Use DDOS firewall protection
At the end the Valet key is exchanged for "strawman" user which is injected into regular AZ principal context (Azos.Security.User)

itadapter commented 3 weeks ago

This complexity is not needed. We have delivered the require functionality using a simple controller with key check which is based on crypto protected messaging for valet keys.

Closing