authentication-service

authentication-service copied to clipboard

Hello there, Marco from Meterian here. We were considering using this component in one of our implementations, but we notice there is not license specified anywhere in the code. Would...

sciortinomrc

Resolves #16 also added "static" dir to lint ignore in package.json and included a docker-compose.yml file that hasn't been used/tested successfully yet but might come in handy

jordandenison

Allow using authentication service as a library

4

I'd like to pull in the backend and front-end js components separately. I have a GraphQL API and would like to write resolvers that use this service. What do you...

chadfurman

Integration of zxcvbn on the default signup and password reset forms would be good

chadfurman

https://github.com/clevertech/authentication-service/blob/master/src/index.js#L333 Also, require email verification for any email changes

chadfurman

Abstract anything touching the DB

1

Rather than using Knex for everything, we should be able to implement the auth-level functionality in SQL ourselves. A couple of issues will benefit from this.

chadfurman

https://github.com/clevertech/authentication-service/blob/17b35bc26257dffd62b01b39997f7349d240cb34/src/index.js#L638 /healthz is from the CT boilerplate project -- not sure you want it in this service? Edit: unless this is supposed to be run in its own Docker container,...

chadfurman

Row-level security and Role-based access control

1

Postgres has some powerful security features that this service does not take advantage of -- likely due to the limitations of knex. I suggest that we have a separate set...

chadfurman

Postgres's pgcrypto would be better here (but less portable)

1

https://github.com/clevertech/authentication-service/blob/master/src/utils/passwords.js For postgres users, it would be better to use pgcrypto's built-in crypt function. We need a way to abstract out db-specific stuff rather than relying on Knex to "just...

chadfurman

Brute force attacks protection

6

There should be protection agains brute force attacks by slowing down the server: - Many failed logins from same IP - Many failed logins to the same email (even if...

gimenete