Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Graphql function to get the user's debatemap Id from a Google Id. #248

Closed
maparent opened this issue Nov 20, 2023 · 1 comment
Closed

Graphql function to get the user's debatemap Id from a Google Id. #248

maparent opened this issue Nov 20, 2023 · 1 comment

Comments

@maparent
Copy link
Collaborator

Needed for claimminer user sync.
There is a minor security risk in that, if an attacker has someone's googleId (which should not be easy) they can determine whether that person is registered in debateMap, and what their public activity was. Given that public activity already gives the person's name, I think this is acceptable.

@Venryx
Copy link
Collaborator

Venryx commented Nov 22, 2023

Regarding the minor security risk, my suggestion: Require that the proposed endpoint be supplied with a special JWT, which we only share with trusted projects that need to do user matching/synchronization (eg. claim-miner).

This way, it cannot as easily be turned into an attack vector. (eg. someone DMs a target user with a link to a fake debate-related website, which on sign-in collects their google-id, in order to then unmask their identity+activity on the debate-map platform)

EDIT: Regarding the person's name, the user is able to edit that from their profile page, so that is less of a concern than their google-id, which cannot be changed AFAIK. The proposed endpoint seems fine to me though, with the added JWT requirement described above. (we can use a very long expiry time; a never-expiring but also never-knowingly-publicly-shared JWT is still much better than none at all)

@Venryx Venryx closed this as completed in 95930e8 Nov 30, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Done
Development

No branches or pull requests

2 participants