fossapps / micro.auth Goto Github PK

This issue was generated by todo based on a todo comment in 72c455f when #33 was merged. cc @fossapps.

while we're using bcrypt to do the hashing, I want to add extra layer of security,

whenever a user enters wrong password, I want to delay the response by LoginAttempts seconds before responding with a login failed.

This also solves bruteforcing issue. (Lockout already solved it, but this will be extra layer of security)

This issue was generated by todo based on a todo comment in ec5cef7 when #63 was merged. cc @fossapps.

Currently I had to enable federation on my own. graphql-dotnet library should eventually enable federation.

If that's ready, update the package. remove custom implementation and use the library's implementation.

the jwt debugger must work & the keystore should also work :), there should be no breaking change for existing applications.

currently only way to login or refresh a token is through REST endpoint which forces those routes to be public.

However, creating a mutation for login and refresh token would clear that and we could simply federate those two.

While the REST api still needs to be available, this wouldn't be a breaking change.

right now everything is on authentication controller, since this is a auth project, we can easily have multiple domains, need to create a signup domain, login domain, reset password domain, change password, etc.

https://github.com/fossapps/Micro.Starter/pull/25/files#diff-9b27a220148e9dc2a96ad951282cc1e6d1e59d536cd93175ff7631b71078bafeR38-R42

all the setup for auth should be done in client, so that it's easy,
can even add KeyStore dependency directly, so that resolving that also can be done from right there,
and lastly RequirePermission attribute can also be implemented right there.

I'm sure no one is using this just yet, but in case anyone needs info,
I'm planning to release a major change which will be available in v2,
this change will remove a lot of endpoints and introduce GraphQL,
only login and refresh endpoints will stay, rest of them will be GraphQL.

Expect apollo federation support as well.

Development will happen in gql branch