search

davidje13 / Refacto

A remote retro facilitation tool.
https://retro.davidje13.com/
GNU General Public License v3.0
23 stars 6 forks source link

Encrypt user-auth keys using master key #23

Closed davidje13 closed 4 years ago

davidje13 commented 4 years ago

Currently, if the database is breached, the key used to sign JWT authentication tokens is available to the attacker. This means that until it is cycled, the attacker can generate and sign login credentials with any details they like, bypassing the encryption of the retro data.

The config table's privateKey should be encrypted in the DB using the same ENCRYPTION_SECRET_KEY which is used for retro data.

davidje13 commented 4 years ago

The key is encrypted using TOKEN_SECRET_PASSPHRASE when exporting the key, rather than as an encryption layer around the database.