Wroclaw/WorkshopTasker
2
1
Fork 1
Code Issues Pull requests Activity Actions

[BREAKING] Auth: replace current auth tokens with more secure ones

Browse source 
previously tokens were only like IDs, time based and incrementing counter.
An attacker could easily bruteforce them.
This patch changes tokens to be completely random.

fixes #2
This commit is contained in:
Wroclaw 2023-11-09 18:28:09 +01:00
parent 434ae5843e
commit ebf5690519
5 changed files with 72 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

10
schema.prisma
View file

@ -20,12 +20,14 @@ model User {
}
model Session {
id BigInt @id @default(dbgenerated("(((unix_timestamp() * 1000) * pow(2,22)) + floor((rand() * pow(2,12))))")) @db.UnsignedBigInt
userId BigInt @map("user") @db.UnsignedBigInt
expiry_date DateTime? @default(dbgenerated("(now() + interval 30 day)")) @db.Timestamp(0)
user User @relation(fields: [userId], references: [id])
id BigInt @id @default(dbgenerated("(((unix_timestamp() * 1000) * pow(2,22)) + floor((rand() * pow(2,12))))")) @db.UnsignedBigInt
userId BigInt @map("user") @db.UnsignedBigInt
sessionToken Bytes @db.Binary(64)
expiry_date DateTime? @default(dbgenerated("(now() + interval 30 day)")) @db.Timestamp(0)
user User @relation(fields: [userId], references: [id])
@@index([userId], map: "user_idx")
@@index([sessionToken])
@@map("sessions")
}