search

floriankramer / penandpaper

A web application for playing pen and paper games over the internet.
Apache License 2.0
0 stars 1 forks source link

Uids need an accompaniyng tsecurity token #3

Closed floriankramer closed 4 years ago

floriankramer commented 4 years ago

With uids having been made public they are no longer sufficient for permissions management.

floriankramer commented 4 years ago

A possible alternative might be setting an auth cookie. A user connecting to index.html with the valid key would receive an auth token which would then be stored in a cookie and allow access to the remainder of the page. This could lead to issued with loading resources though. Potentially, a separate start page and a redirect would be required.