Summary
Users do not and should not have passwords. Instead, upon signing up, an initial token is created with the session:create
grant (and nothing else). This login token is used to log in, containing the uid and name. Login tokens should expire after a long time (30-90 days) and be treated like passwords. Users should be told in no uncertain terms to keep the login token in their password manager.
A "password reset" means deleting all existing tokens for a user, including their login token, and immediately (transactionally, even) issuing a new login token. This replaces all existing tokens and can be used to re-issue others.
Scope
Use Case
Implementing passwords opens up a million security concerns. Without passwords, most of them don't exist.
Security for tokens relies largely on the secrecy of the secretOrKey
used to sign them. This is taken from config, meaning it can be an !env
variable or !include
d from a mounted kind: Secret
.
Issues
Ensure users cannot get stuck without a login token.
Details
Add anonymous roles (roles for an anonymous user) to the session controller. Any context without a user should be given these roles and their grants. Default to session:create
and user:create
, most likely.
In some controller, implement the sign up flow (create user, create token, reply with token) and reset flow (delete tokens, create token, reply with token). The sign in flow is already in session ctrl. Group these three and write some tests.