reznik99 / foxtrot-backend Goto Github PK

JWT token is issued to the user on login
This token is never renewed.

There should be an endpoint for

• Validating the current JWT
• Renewing the JWT in some secure way without making the user re-authenticate

Enstablish Websocket connection to device

This is to send messges to the device in real time without having the user preform a refresh (drag down in main app page)

This doesn't solve notifications, but could be used for Audio calls and maybe Video calls (Might have to use WebRTC for that)

Messages should:

• Initially be encrypted directly with the user's RSA Keys.
• Encrypted using session/rolling symmetric keys to be shared using the user's RSA Keys
  • Symmetric session keys should be generated PER conversation

JWT-Secret is stored as environment variable. This secret is an ASCII secret/password.

The jsonwebtoken library uses this value as a raw AES Key for HMAC auth0/node-jsonwebtoken#620

To improve security, the JWT-Secret should be put through a KDF function like Argon2ID, scrypt, bcrypt or PBKDF2 on start-up before any JWTs are signed.