Add proper replay protection

pdsinterop / php-solid-server

Standalone Solid Server written in PHP by PDS Interop

https://pdsinterop.org/php-solid-server/

MIT License

45 stars 7 forks source link

Add proper replay protection #68

Open michielbdejong opened 10 months ago

michielbdejong commented 10 months ago

I copied the replay detector from Solid-Nextcloud but this server does not have a database server so I didn't find a good way to store/query previously used JTIs.

I disabled it for now to see if I can get the tests to pass, but at the very least we should implement this with storing the data in some text file or something.

Potherca commented 2 weeks ago

The current storage engine for the PHP Solid Server is "on disk", using FlySystem so "disk" does not have to be a local disk but could also be an AWS S3 bucket, or a Database, etc.

I think ypur first effort (on the test-suite-fixes-2023, adding src/DpopFactoryTrait.php and src/JtiReplayDetector.php, is a good start. (Although we might want to place those files in another location).