Repository navigation
feat(auth): revoke refresh tokens with a per-user token version (#104) - #107
Merged
Merged
Conversation
Refresh tokens were stateless for their whole 90 days. Changing the master password returned new tokens but left every earlier refresh token working, and nothing could sign a device out from the server. users.token_version is written into the refresh token as `ver` and compared on every refresh. Changing the password bumps it, and POST /v1/auth/logout-all bumps it on request. Both hand the caller a pair minted at the new version and send token_invalidated so other devices find out at once. Tokens issued before this decode as version 0 and stay valid until the first bump. /v1/auth/refresh moves to its own per-IP budget. Released clients retry a refused refresh every five seconds from the sync loop, which on the shared auth budget would have locked the same address out of signing in. The three copies of "access token + refresh token + map_err" in register, login and password change are now one issue_session.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #104.
What changes
users.token_version INTEGER NOT NULL DEFAULT 0.ver.refreshanswers401when it differs from the column. The column is read in the queryfetch_tieralready ran, so there is no extra round trip.update_passwordbumps the version in the sameUPDATEthat stores the new hash.POST /v1/auth/logout-all(authenticated): bumps the version and returns{jwt_token, refresh_token}for the caller.token_invalidated, so other devices try to refresh immediately and get the401.Compatibility
verand decode as0, which matches the column default. Nobody is signed out by the deploy.401on refresh: the sync loop retries every five seconds. On the shared 10/min auth budget that would block sign-in from the same address, including the retry the user needs./v1/auth/refreshnow has its own per-IP budget (three timesAUTH_RATE_LIMIT). The client-side prompt is Optional two-factor authentication for cloud accounts: enrolment and sign-in code step voltius#615.Refactor
register,loginandupdate_passwordeach built an access token and a refresh token with their ownmap_err. They now shareissue_session, andrefreshsharesaccess_token_for.Tests
logout-allrefuses every earlier refresh token, returns a working pair, and emitstoken_invalidated.verrefreshes until the first bump.cargo test --all-targets(697 passed) andcargo clippy --all-targets -- -D warningsagainst Postgres 16.One more in-process rate limiter, of the kind
CLAUDE.mdalready lists; it moves to Postgres with the others.