auth to-do list

[jameshadfield]

For prototype

• [ ] JWT expiry
• [ ] decode JWT in client to get username
• [ ] a development flag to ignore authentication (!)
• [ ] test JWT
• [ ] set up protected S3 URL for data & access from server
• [ ] remove delete token button on login page
• [ ] changing password doesn't revoke JWTs, so a user is still authenticated
• [ ] incorrect username/passwords remain filled in after failure
• [ ] show spinner (e.g.) after clicking "login"

For real usage

• [ ] login rate limiting & max retries
• [ ] ability to revoke JWTs & client check JWT hasn't been revoked
• [ ] store hashed passwords (server) -- see note in server/auth.js
• [ ] user db or similar

[tsibley]

It might make more sense to delegate authentication to an external service instead of building it ourselves. There are several we could use, e.g. Auth0.

[jameshadfield]

Could do. Passportjs and Auth0 work well together.

[jameshadfield]

Auth for prototype (discuss)