JWT token security - Githubissues

waikato-ufdl / ufdl-python-client

Core Python library for accessing the UFDL backend, managing the communication.

Apache License 2.0

0 stars 0 forks source link

JWT token security #4

Open csterling opened 4 years ago

csterling commented 4 years ago

Tokens are currently stored in plain-text on disk. Anyone who gains access to the token can authenticate as the user.

Investigate ways of shoring up this problem.

fracpete commented 4 years ago

A simple measure would be to ensure that the parent directory (on Linux) has 0700 as octal permissions and 0600 on the file itself (like $HOME/.ssh).