search

fredi-68 / luswca

Remember to put full project title here
GNU General Public License v3.0
0 stars 0 forks source link

User authentication, sessions #43

Closed fredi-68 closed 5 years ago

fredi-68 commented 6 years ago

Currently the only requirement to play on an existing user account is to know its name. Passwords are not being checked, and neither are session tokens. This means not only can anyone who manages to connect to the server play on any account; the same character can load into the game multiple times at once.

fredi-68 commented 5 years ago

I've added the ability for different characters from the same user account to be loaded into the game by passing the character ID through the account database. In theory, the same system could be used to manage the session tokens as well. However, this would require the implementation of user passwords which are currently not checked, since session authentication doesn't make much sense without user authentication at the auth level.

fredi-68 commented 5 years ago

Legacy database session management has been replaced by the orchestrator service.