Comments (7)
Because of that, we may consider a better alternative. For me two most important requirements are:
- backwards compatible
- does not introduce a configuration option to Tiddle
What I came up with is:
- add
expires_at
field to the table that stores authentication tokens - add
expires_at
keyword argument defaulting to nil toTiddle.create_and_return_token
- in the strategy compare
expires_at
with the current time and refuse to authenticate user when the token is too old.
This allows to precisely specify the expiration time, and, for example, use different values depending on user role (admin, non-admin).
Does this sound reasonable?
from tiddle.
@adamniedzielski I actually went other way with implementing devise_token_auth
- it was more fitting into our policy as it's compliant with RFC 6750 Bearer Token. However I made the adjustments prior to that. I'm gonna open a PR in a bit. Commits are messy as I committed a bunch of rubocop based fixes reverting them later to make PR more strict to the topic.
from tiddle.
Implemented by #37
from tiddle.
@DamirSvrtan thanks for the great discussion (and presentation) about that at Southeast Ruby.
As I said, the project from which I extracted Tiddle didn't have a need for tokens that expire after a certain amount of time. However, it sounds like a very reasonable use case so I'm willing to cover it.
The most "straightforward" option that I can see is manually adding a Rake task that does something like:
AuthenticationToken.where("created_at < ?", 2.weeks.ago).delete_all
This has the disadvantage of being imprecise. If the Rake runs every hour then we have a chance of allowing authentication with a token that should have already been expired.
from tiddle.
I'd like to chip in, as I'm on a lookout for token based auth for app I'm working on and your gem has attracted my attention.
Time based expiration/revoke mechanism is a must in my opinion. I'm actually surprised that it wasn't included by default. I want to implement an api handling self expiring tokens, but it would require multiple tokens in order for the api to be accessed by multiple devices, without cutting them off all at once when token gets revoked.
What you propose above seems like the most feasible option. I actually wanted to fork this and try to add this part myself, when I noticed this issue. I'm eager to see this in action.
from tiddle.
Also, I have another idea. Facebook, for example, expires/revokes the tokens after a period of inactivity. So maybe:
- instead of
expires_at
maybe useexpires_in
integer field - keyword argument would also be names like
expires_in
where you could pass a duration argument like3.months
- strategy would take
last_used_at
withexpires_in
added, which, when compared with current time would revoke the token or not
What do you think? It would be more flexible, without necessarily forcing users to relogin if they use the api/token on regular basis.
from tiddle.
@riggy thanks for contributing to the discussion!
I'm actually surprised that it wasn't included by default.
As I said earlier, this wasn't the focus of the project I extracted this gem from.
I actually wanted to fork this and try to add this part myself
Please do and contribute back as a PR!
I'm fine with the approach that you presented (expiring the token after a period of inactivity).
from tiddle.
Related Issues (20)
- Version 1.0 HOT 2
- Fix Rubocop offences
- DEPRECATION WARNING: ActionDispatch::IntegrationTest HOT 7
- Error after installed Tiddle HOT 3
- Can't change maximum token per user
- Support devise > 4.3.X HOT 2
- Remove unnecessary secure compare
- Devise 4.4 HOT 4
- [Question]: What for sending X-USER-EMAIL ?
- Update required fields for README HOT 2
- Tiddle can not work with devise 4.5.0. HOT 3
- Soft purge setting `revoked_at` instead of destroying auth tokens? HOT 2
- Devise can not be updated past version >=4.6
- [Question] Cookieless Tiddle & ActionCable HOT 2
- Multiple types of Users HOT 1
- Token last_used_at not being updated properly HOT 5
- Tokens pile up in the database forever HOT 1
- Switch dev setup to use Docker
- Mongoid support HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from tiddle.