JWT Authentication Rework - Githubissues

sensu / sensu-go

Simple. Scalable. Multi-cloud monitoring.

https://sensu.io

MIT License

1.01k stars 177 forks source link

JWT Authentication Rework #5007

Closed ccressent closed 1 year ago

ccressent commented 1 year ago

What is this change?

Add refresh token rotation, to reduce the impact of stolen refresh tokens
Add a session store, used to detect and prevent refresh token reuse
Use a new SessionID custom claim in the JWTs
The session store allows for server side "refresh JWT invalidation"

Why is this change necessary?

Fix and mitigate https://github.com/sensu/sensu-enterprise-go/issues/2605

Does your change need a Changelog entry?

Added.

Have you reviewed and updated the documentation for this change? Is new documentation required?

No new documentation needed.

How did you verify this change?

Unit and integration tests
Manual testing

Is this change a patch?

No.