os-js/OS.js

Auto login via cookie

yoyosaygood opened this issue · 16 comments

yoyosaygood commented

how to record the login status.If I'm already logged in, I'll enter automatically next time

andersevenrud commented

I will look at this ASAP.

  • ❤️3
mikeblackstock commented

Me too I would love to have this capability

  • 👍1
andersevenrud commented

I've started looking into this.

FYI: This will only work for the official database authentication adapter. So no support on PAM, at least for now. Mostly because this requires implementing a custom mechanism.

Any adapter that uses a third party authorization service (like Auth0) can already do this :)

  • 👍1
mikeblackstock commented

FYI: This will only work for the official database authentication adapter.
Is that this one?
https://github.com/os-js/osjs-database-auth

andersevenrud commented
mikeblackstock commented

re. "Maybe it could be an option?"
I did a quick search, and login systems with cookies for user/password state persistence
use some combination of encryption/hash/salt on the password in the cookie... maybe,
for now, stick to the official database authentication adapter implementation and defer
universality for down the road? Best not implement stuff you're not comfortable with.

andersevenrud commented

The plan is to generate a remember token that's a unique hash when user logs in and store that in the database and then the token+username in the cookie with some lifetime. When the system starts up it will try to detect this cookie and do a login with the information stored there. If the token has lapsed you'll just get the standard login form with a message to try to log in again.

  • 👍1
andersevenrud commented

Also, this token is destroyed on a regular logout.

andersevenrud commented

Hey y'all. I just released @osjs/client@3.6.0 which includes support for insecure cookie auto-login. I know I said I was not comfortable with this, but I've added a configuration option that will make it possible to switch to a more secure mode in the future (which will then be the default).

So if you update you can now add the following to your config:

{
  auth:  {
    cookie: {
      enabled: true,
      epxires: 7 // days -- this is the default value
    }
  }
}
  • 👍1
andersevenrud commented

This insecure method will work on all authentication adapters since it stores the actual login and not some token, FYI.

hello-smile6 commented

What about a hash of an authentication token that's IP-locked?

hello-smile6 commented

What about a hash of an authentication token that's IP-locked?

So it couldn't be hacked as easily.

andersevenrud commented

@hello-smile6 That might not be desirable because because if the user changes their connection/location they would not be automatically logged in anymore.

But I suppose it could be added as an option when it comes to the "secure" implementation of this mechanism. It's not possible in the "insecure" method because it's entirely client-side. Not 100% sure though, because if IPs is of concern then there's ways to whitelist this in the front-facing reverse proxy (like nginx), or as middleware on the node server.

mikeblackstock commented

This is great Anders - I configured it and it's running perfectly :)
PS - I'm guessing there's a typo below and 'epxires' should be 'expires'?
M.

Hey y'all. I just released @osjs/client@3.6.0 which includes support for insecure cookie auto-login...
...
auth:  {
cookie: {
enabled: true,
epxires: 7 // days -- this is the default value
}

andersevenrud commented

@mikeblackstock Glad to hear it! And yeah, that's indeed a typo 😊

andersevenrud commented

Closing this issue. This will be superseeded by issues in the associated repos.