opoll / opollminer

Official mining application for OpenPoll Platform
1 stars 0 forks source link

remove once valid token endpoint #44

Closed zack-w closed 6 years ago

zack-w commented 6 years ago

There should not be a once valid token endpoint. The proper flow is the following:

  1. user loads miner application
  2. miner application checks leveldb for auth token (the token itself, not the base64 containing the IP and Port, just the code). if one exists, it uses that one. if none exists, it generates a new code and stores it.
  3. miner generates an authorization code which is token;ip;port base64'd and then prints this to console. this code can by copy-pasted into the angular GUI to access the miner.
  4. angular GUI sends the token as the authorization in all requests.

at no point in the flow should there be automatic authorization. the angular app should store the token locally in a cookie or session storage. during first launch, the user will have to get the token / authorization code from the console to access the admin interface. otherwise, we have a security hazard for unmaintained miners.

https://github.com/opoll/opollminer/blob/a3bdc33d90c91adb020ae5ecd7b69f3e1992e876/lib/network_module.js#L46

bephrem1 commented 6 years ago

Issue resolved and updates pushed to respective develop branches