Closed rosarp-gobazzinga closed 9 months ago
Change user_identity to some signature with expiration. Remove from json payload, put in http cookie. Page redirect:
To Check:
identification need to be constant, as it is key in KV store. So adding expiration & pubkey etc and hashing it wont be helpful. As hash/signature will keep on changing if expiration changes.
Possible solution: HS256(Base64(pubkey)) , encrypt with (server side) users private key and send across. Which can then be used as key in KV store. store directly.