search

upb-uc4 / lagom-core

Repository for the micro service backend using lagom.
Apache License 2.0
6 stars 0 forks source link

Tokens of deleted users are still valid #306

Open RHelmert opened 4 years ago

RHelmert commented 4 years ago

If a user gets deleted, their token is still valid and can be used for authentification.

Expected behaviour: Upon user deletion the token should get invalidated .

ldklenner commented 4 years ago

To invalidate tokens we have to set up a database either operating as a allow or deny list. When a user request a service its token has to be checked against the database. To prevent that the database is slowly filled with already expired tokens a periodically cleaning job has to be executed. Peridocal jobs can be realized with the Akka scheduler, for an Lagom example see this.