Switch from token-based to OIDC-ish login

[nyiyui]

Currently, the app and React-based client uses the /api/auth/token endpoint with a username+password pair to login the user. /api/auth/token relies on JWTs (pros/cons listed below), and

Pros to /api/auth/token

• nothing that I can think of Cons to /api/auth/token:
• extra RSA certificate to take care of
• non-instant token expiry (might be wrong, but I'm not aware of such a feature in the Django backend code)
• more attack surface (3 ways of logging in - /api/auth/token, Django (web+admin), OAuth/OIDC-ish)

Two ways to move forward:

Authentication Proxy Server

app and client uses a authentication proxy server (authproxy) (have to check if this is secure) with Resource-Owner Password (ROP) flow. authproxy is required to make OAuth client confidential. Pros:

• look-and-feel is preserved (especially app) Cons:
• more code (but separate from Django backend code)

Migrate to OIDC

app and client migrates to OIDC (no ROP flow) Pros:

• less attack surface - 2 ways of logging in - Django (web+admin) and OAuth via Django Cons:
• look-and-feel is disrupted (especially app)

[JasonLovesDoggo]

no authproxy. we do not need an extra service

[nyiyui]

Agreed... I would've loved writing security-critical code in RISC assembly, though! (just kidding)

[nyiyui]

/cc @Trentiumz @mars-flat as client and app leads

[JasonLovesDoggo]

Agreed... I would've loved writing security-critical code in RISC assembly, though! (just kidding)

I don't trust your "secure" code.... you've printed passwords & allowed anyone to bypass all authentication on api 😨

[nyiyui]

That's true! I'm sure I've learned lessons from them, and 90% sure I won't make those mistakes again (by staying away from security code...)!

[JasonLovesDoggo]

That's true! I'm sure I've learned lessons from them, and 90% sure I won't make those mistakes again (by staying away from security code...)!

to anyone reading this in the future... ken is a very trustworthy and cool person!!! HIRE THEM (and me too pls I'm probably struggling and jobless.....wow look at my cool contribution history)