guardicore / monkey

Infection Monkey - An open-source adversary emulation platform
https://www.guardicore.com/infectionmonkey/
GNU General Public License v3.0
6.66k stars 782 forks source link

Refresh the token based on user activity #4008

Open cakekoa opened 9 months ago

cakekoa commented 9 months ago

Our authentication protocol requires that the client obtain an updated token on a regular basis in order to keep the session alive. One method for doing this is to check if the token needs to be refreshed whenever the client communicates with the Island. This would be fine if every request were initiated by a user interaction, however we expect that the client will also need to send requests in the background, which we may not want to count toward keeping the session alive. Moreover, we have pages like the Map page which we largely expect the user to remain idle while the Monkey completes its run, and we'd like the session to remain up as long as a human is actively observing it. Ultimately we'd like to avoid the closing the session and redirecting the user to the login screen while the user is actively using the web interface.

One potential solution would be to use the react-idle-timer in the main layout (so that it's a part of every page) to help determine if and when to initiate a token refresh.

cakekoa commented 9 months ago

Consider potential use of websockets for updating things like the map