Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Feature request: disable encryption for server-side tokens

See original GitHub issue

Hello,

First of all let me thank you for all your work and good product!

Do you have any plans to add an option to not use encryption on server-side tokens?

We’re deploying our clusters quite frequently and encryption for tokens isn’t always working for us. We’re trying to avoid node scripts (for our own reasons), and were using openssl script at first, and python script currently. Rarely we have digital envelope routines errors, after token creation, hence the need of regenerating of tokens. We’re using only server-side tokens. Don’t get me wrong, but I don’t see much sense of using encryption on server-side tokens.

Issue Analytics

State:
Created 4 years ago
Comments:8 (7 by maintainers)

Top GitHub Comments

1reaction

travisghansencommented, Jan 15, 2020

Yeah it has to be the actual jwt for sure. Otherwise signatures could not be checked and I don’t think it would be good to have the app signing jwts either.

I’ve got some other PRs to review so I’ll look into this one as well.

1reaction

travisghansencommented, Jan 14, 2020

Thanks for the interest and kind words! Glad to hear you find the project useful. I had some specific reasons for requiring them to be encrypted even on the server-side but I’ll have to dig through my notes to see if I can find them again. Generally I’m open to not requiring it though. I’ll do some digging and then reach back out.

Top Results From Across the Web

Token Best Practices - Auth0

Embrace HTTPS: Do not send tokens over non-HTTPS connections as those requests can be intercepted and tokens compromised. Consider all of your authorization...

Disable your API token - DigiCert product docs

On the Admin page, in the API Tokens section, in the Filter certificates by dropdown, select Valid. Locate the API token and select...

Acquire and cache tokens with Microsoft Authentication ...

You can also clear the token cache, which is achieved by removing the accounts from the cache. This doesn't remove the session cookie...

Handling encrypted tokens - PingDirectory - 9.1

Without this public encryption key, the issuer cannot encrypt tokens that can be decrypted by the JWT access token validator. The following ...

Verification token encryption/hashing to prevent email security ...

Detail about proposed feature. When requesting a token to an email address, the server should send back a randomly generated key as a...