Allow encrypting access tokens in Prisma dbs #819
Conversation
paulomarg
force-pushed
the
encrypt_access_tokens
branch
2 times, most recently
from
a425cfe to
ebf73ed
Compare
paulomarg
force-pushed
the
encrypt_prisma_session_access_tokens
branch
from
fdcc677 to
1450a59
Compare
paulomarg
force-pushed
the
encrypt_access_tokens
branch
from
ebf73ed to
5689d31
Compare
paulomarg
force-pushed
the
encrypt_prisma_session_access_tokens
branch
from
1450a59 to
907f5e9
Compare
| scope: sessionParams.scope || null, | ||
| expires: sessionParams.expires ? new Date(sessionParams.expires) : null, | ||
| accessToken: sessionParams.accessToken || '', | ||
| userId: (sessionParams.onlineAccessInfo as unknown as bigint) || null, |
There was a problem hiding this comment.
We still want just the ID here?
sessionParams.onlineAccessInfo?.associated_user.id
There was a problem hiding this comment.
I think I need to rebase this onto your PR that returns the user info?
There was a problem hiding this comment.
You shouldn't. The current functionality should have the ID in the sessionParams.onlineAccessInfo?.associated_user.id
There was a problem hiding this comment.
That changed slightly because we're using the property array here instead of toObject.
There was a problem hiding this comment.
You shouldn't
I think we should still be setting all of the user fields here though, right? That's why I was thinking about rebasing.
|
In the end, we decided not to go forward with this as developers are probably better served by using encryption at the infrastructure level for their production databases, rather than making the API more complex at the software level. |
WHY are these changes introduced?
With the ability to encrypt access tokens built into the
Sessionclass (#818), we should update our storage options to included that for an extra layer of security.WHAT is this pull request doing?
Adding a new parameter to
PrismaSessionStorageto pass in an encryption key to be used to encrypt data. This doesn't require apps to migrate right away since we can update rows as they rotate, but we should still recommend apps load and store every session (or wipe their table).Type of change
Checklist
yarn changesetto create a draft changelog entry (do NOT update theCHANGELOG.mdfiles manually)