feat!: Issue JWT for session pre-authentication #1927
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
API Changelog 4.9.1.dev2+gcd986def |
This comment has been minimized.
This comment has been minimized.
MoritzWeber0
force-pushed
the
pre-authentication-jwt
branch
from
0cc22d9 to
3f102c9
Compare
This comment has been minimized.
This comment has been minimized.
MoritzWeber0
force-pushed
the
pre-authentication-jwt
branch
from
3f102c9 to
f61f8be
Compare
This comment has been minimized.
This comment has been minimized.
MoritzWeber0
force-pushed
the
pre-authentication-jwt
branch
from
f61f8be to
4517e50
Compare
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1927 +/- ##
==========================================
+ Coverage 84.73% 84.80% +0.06%
==========================================
Files 208 211 +3
Lines 6785 6875 +90
Branches 466 472 +6
==========================================
+ Hits 5749 5830 +81
- Misses 874 879 +5
- Partials 162 166 +4 ☔ View full report in Codecov by Sentry. |
This comment has been minimized.
This comment has been minimized.
MoritzWeber0
force-pushed
the
pre-authentication-jwt
branch
from
4517e50 to
18231ce
Compare
This comment has been minimized.
This comment has been minimized.
MoritzWeber0
force-pushed
the
pre-authentication-jwt
branch
from
18231ce to
df53de3
Compare
This comment has been minimized.
This comment has been minimized.
MoritzWeber0
force-pushed
the
pre-authentication-jwt
branch
from
df53de3 to
7b43e38
Compare
This comment has been minimized.
This comment has been minimized.
MoritzWeber0
force-pushed
the
pre-authentication-jwt
branch
from
7b43e38 to
3007a67
Compare
This comment has been minimized.
This comment has been minimized.
Instead of the non-structured session token, issue a JWT containing `session_id`, `user_id`, `user_name` and `user_role`. More claims will be added in the future. During session connection, the backend issues a signed JWT token. The private key is auto-generated in the backend (if it doesn't exist) and can be exchanged via new CLI endpoints. The JWT is validated automatically for all requests to HTTP-based sessions. The JWT can be read from the `ccm_session_token` cookie and can be trusted by sessions. It may be used to extract user or session information in the sessions. The validate_token endpoint doesn't require an active database session anymore, reducing network traffic and improving the response times. This effectively makes sessions faster and improved stability. BREAKING CHANGE: Users with active sessions have to reconnect to their sessions after the update has been rolled out. We recommend to install the update when there are no active sessions.
MoritzWeber0
force-pushed
the
pre-authentication-jwt
branch
from
3007a67 to
99fe4b6
Compare
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Instead of the non-structured session token, issue a nested JWT containing
session.id,user.id,user.name,user.emailanduser.role. More claims will be added in the future.During session connection, the backend issues a signed JWT token. The private key is auto-generated in the backend (if it doesn't exist) and can be exchanged via new CLI endpoints.
The JWT is validated automatically for all requests to HTTP-based sessions. The JWT can be read from the
ccm_session_tokencookie and can be trusted by sessions. It may be used to extract user or session information in the sessions itself.The validate_token endpoint doesn't require an active database session anymore, reducing network traffic and improving the response times. This effectively makes sessions slightly faster.
One of the best changes is for our developers: It's finally possible to reach sessions from the live-refresh environment again :)
BREAKING CHANGE: Users with active sessions have to reconnect to their sessions after the update has been rolled out. We recommend to install the update when there are no active sessions.