Lobo_Corp/ToBePlayed-Auth
Public Access
3
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Changed from JWT token to public/privat key

Browse Source
This commit is contained in:
Andreas Dahm committed 2026-05-12 08:56:51 +02:00
1 parent 4859e74d45
commit 9114eb096b
5 files changed
+161 -132
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

readme.md
+1 -1
View File
@@ -87,7 +87,7 @@ Tracking known work that is not yet implemented. Each item is independently acti
### Security
- **Switch JWT signing from HS256 → EdDSA (Ed25519).** Today Auth and Core share a symmetric `JWT_SECRET`, which means a Core compromise lets an attacker forge tokens. Move to an asymmetric keypair: Auth holds the private key and signs, Core only holds the public key and verifies. `jjwt 0.13` supports this via `Jwts.SIG.EdDSA`; JDK 25 has native `Ed25519` `KeyFactory`. Touches `JwtService`, `JwtConfig`, `application.yml`, `JwtServiceTest`, and the deployment env vars (`JWT_PRIVATE_KEY`, `JWT_PUBLIC_KEY` replace `JWT_SECRET`). Add a `kid` header so future rotation is possible.
- ~~**Switch JWT signing from HS256 → EdDSA (Ed25519).**~~ Done. Auth signs with an Ed25519 private key (`JWT_PRIVATE_KEY`), Core verifies with the matching public key (`JWT_PUBLIC_KEY`). `kid` header (`JWT_KID`) is emitted to support future rotation. See `JwtService`, `JwtConfig`, `application.yml`, `JwtServiceTest`, and `ToBePlayed-Deployment/README.md` for the rollout / rotation procedure.
- **Refresh-token rotation.** Current access tokens last 24h with no revocation path. Split into a short-lived (5–15 min) access token and a long-lived (7–30 day) refresh token, rotated on every use, persisted server-side so logout / password change / "log out everywhere" actually revoke. Add a `token_version` column on `users` (or a `jti` blacklist table) checked on each refresh.
- **Move JWT delivery to an httpOnly `Secure` cookie.** Tokens are currently returned in the response body and stored by the frontend in `localStorage`, exposing them to any XSS payload. Set the cookie server-side, scope it to `.tbp.andreas-dahm.eu`, and add CSRF protection (Spring Security's `CookieCsrfTokenRepository.withHttpOnlyFalse()`).
- **Tighten CORS for cookie auth.** Restrict allowed origins to `https://tbp.andreas-dahm.eu` (plus the local dev origin) and set `allowCredentials=true`. Required before switching to cookie-based JWT.