Expire authentication tokens #7140
Merged
+118
−24
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
link2xt
force-pushed
the
link2xt/ykltkokxntvk
branch
from
701dafe to
30a434b
Compare
link2xt
force-pushed
the
link2xt/expire-auth-tokens
branch
2 times, most recently
from
e8ff198 to
071b35a
Compare
link2xt
force-pushed
the
link2xt/ykltkokxntvk
branch
2 times, most recently
from
b6d01bd to
0b8c3ca
Compare
link2xt
force-pushed
the
link2xt/expire-auth-tokens
branch
2 times, most recently
from
54eb0b1 to
18c5fb0
Compare
link2xt
force-pushed
the
link2xt/ykltkokxntvk
branch
2 times, most recently
from
904e5a3 to
d8c237b
Compare
link2xt
force-pushed
the
link2xt/expire-auth-tokens
branch
from
18c5fb0 to
3e6c621
Compare
link2xt
force-pushed
the
link2xt/ykltkokxntvk
branch
from
d8c237b to
6d9ce24
Compare
link2xt
force-pushed
the
link2xt/expire-auth-tokens
branch
2 times, most recently
from
0310a22 to
1e9c0e9
Compare
link2xt
force-pushed
the
link2xt/ykltkokxntvk
branch
from
6d9ce24 to
b91322a
Compare
link2xt
force-pushed
the
link2xt/expire-auth-tokens
branch
from
1e9c0e9 to
9af5cbe
Compare
link2xt
force-pushed
the
link2xt/ykltkokxntvk
branch
2 times, most recently
from
49f6b8d to
83a9265
Compare
link2xt
force-pushed
the
link2xt/expire-auth-tokens
branch
from
9af5cbe to
2c3004d
Compare
link2xt
force-pushed
the
link2xt/expire-auth-tokens
branch
from
2c3004d to
5d35ac2
Compare
link2xt
force-pushed
the
link2xt/ykltkokxntvk
branch
2 times, most recently
from
45c2c57 to
8886ac4
Compare
link2xt
force-pushed
the
link2xt/expire-auth-tokens
branch
2 times, most recently
from
6f67e0e to
cb19c82
Compare
link2xt
force-pushed
the
link2xt/ykltkokxntvk
branch
from
8886ac4 to
c64ea59
Compare
link2xt
force-pushed
the
link2xt/expire-auth-tokens
branch
from
cb19c82 to
297d6aa
Compare
link2xt
force-pushed
the
link2xt/ykltkokxntvk
branch
from
c64ea59 to
9086f0f
Compare
link2xt
force-pushed
the
link2xt/expire-auth-tokens
branch
from
297d6aa to
d69155e
Compare
link2xt
force-pushed
the
link2xt/ykltkokxntvk
branch
from
9086f0f to
1871031
Compare
link2xt
force-pushed
the
link2xt/expire-auth-tokens
branch
from
d69155e to
273c547
Compare
link2xt
force-pushed
the
link2xt/ykltkokxntvk
branch
from
1871031 to
f5d3f7f
Compare
link2xt
force-pushed
the
link2xt/expire-auth-tokens
branch
4 times, most recently
from
0f1c10f to
10b2b85
Compare
link2xt
force-pushed
the
link2xt/expire-auth-tokens
branch
from
10b2b85 to
b09bf6c
Compare
link2xt
force-pushed
the
link2xt/ykltkokxntvk
branch
2 times, most recently
from
4b85764 to
f035394
Compare
link2xt
force-pushed
the
link2xt/expire-auth-tokens
branch
6 times, most recently
from
23b03d3 to
1c52a19
Compare
link2xt
force-pushed
the
link2xt/ykltkokxntvk
branch
from
f035394 to
9225ad2
Compare
link2xt
force-pushed
the
link2xt/expire-auth-tokens
branch
from
1c52a19 to
025d9f1
Compare
|
This is merged into parent PR, not main |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Based on #7116.
Depends on #7176
Closes #7111
Currently we have tokens table which stores invite tokens and auth tokens. Tokens are indexed by
foreign_key(group ID or empty string in case of contact setup QR codes) and normally there is only one token unless token has been synced from another device.With this change we generate a new auth codes each time QR code is shown. Each auth token has a timestamp, and 10 minutes later it is considered expired. Expired auth token still works for joining groups, but does not result in verification on Alice's side.
To clean up auth tokens eventually we have a PR #7176 that changes how we reset QR codes. Once one QR code is reset, all related tokens are removed.