realulim commented on issue #844: Security: Provide a Way to Delete Cookies URL: https://github.com/apache/couchdb/issues/844#issuecomment-333333038 Let me rephrase my last comment, it was written in too much of a hurry, for which I apologize. What I didn't understand is that "stateless tokens" in CouchDB actually means more than simply not storing tokens. It means "no sessions". You could have sessions with stateless tokens (see my example below). The point of token authentication in a general sense is that the user does not have to send his credentials with every request, so if a token is intercepted (CSRF, MITM, ...) the attacker has less than the credentials. "Less" means, for example, that once the user "logs out", all tokens become worthless. The point of this ticket was to suggest this functionality - a way to invalidate all tokens still out there. However, the server would have to store at least the timestamp of the last "log out" operation, then it could refuse all tokens coming in after that timestamp. The next "log in" event (session creation) would then delete this timestamp. And session creation is only possible with the credentials, which the attacker doesn't have (I assume the credentials are hashed/salted). A completely stateless solution is not possible, because all the token contains is the user's credentials and we cannot invalidate the credentials. But storing one additional timestamp per user would still be stateless in the sense that it doesn't change CouchDB's scaling properties. It is not a per-session value (which indeed would affect scalability), but a per-user value that could even be eventually consistent. ---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected]
With regards, Apache Git Services
