search

tuupola / branca-spec

Authenticated and encrypted API tokens using modern crypto
https://www.branca.io/
219 stars 7 forks source link

Suggestion to expiration check #28

Closed brycx closed 3 years ago

brycx commented 3 years ago

I think it would make sense to specifically state, that the expiration check for a token using a ttl should happen after authenticating and decrypting. If it happens before, a user would never know if an expired token they received was tampered into expiring, or actually did expire.

tuupola commented 3 years ago

You are correct. I was reading https://github.com/return/branca/issues/7 and though it should be mentioned in the spec.