3 ms·
Do you sign a request with that reauth token or do you send the reauth token? Because if they’re getting mitm then all is lost. How long does the reauth token l
by skinner927 3y ago
Do you sign a request with that reauth token or do you send the reauth token? Because if they’re getting mitm then all is lost. How long does the reauth token last for? Is a new one issued when you reauth?
As negative as I sound, the system is better than just allowing the regular api token to extend the session. Of the hundreds to thousands of api requests a regular user may make a day, only 1 is the reauth, which is nice.
Security is an onion. Every layer is a bit sour and eventually you’ll cry.
- jedberg 3y ago> Do you sign a request with that reauth token or do you send the reauth token? Sign > Because if they’re getting mitm then all is lost. This is true regardless of your authentication scheme, which is why https is important and then you have to hope they didn't just click through a warning and ignore it or have their trust store compromised or.... > How long does the reauth token last for? Until it is reissued. But since the auth token is only good for 12 hours, effectively 12 hours max, since it can't be used for reauth without a valid auth token. > Is a new one issued when you reauth? Yes.
- derangedHorse 3y agoWith mitm everything is lost. I could just wait until the user gets a reauth token again, assuming the reauth token expires (which it always should). Netflix had an issue a couple years back where sessions would never expire and you could use Netflix for years with the same session cookie.