r-anime/awards-web

Json Web Token Authentication Where Applicable

Closed this issue · 0 comments

Currently, we use a really bad system where to speed up API overhead caused by the server requesting to reddit, we confirm certain data from session info leaving the site vulnerable to session forgery. The authentication method in helpers/auth.js should be modified to use JWTs instead. Generate one everytime the user logs in via reddit and store it in the session, then have the API check it every time a call is generated.

See https://www.npmjs.com/package/jsonwebtoken

I've implemented this in a project so you can ask for help @pandavenger