Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

API token tweaks #388

Draft
wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

API token tweaks #388

wants to merge 2 commits into from

Conversation

lfdebrux
Copy link
Member

@lfdebrux lfdebrux commented Dec 15, 2023 •
edited
Loading

What problem does this pull request solve?

While working on #368 I realised that we don't have anything preventing the same API token being used more than once. This seemed like a bug to me, so I've tried to fix it.

I've also thought it would make API keys easier to identify if they have a prefix, the same way GitHub or Trello does, so I added that as well.

These changes shouldn't stop any existing API tokens from working.

Things to consider when reviewing

  • Ensure that you consider the wider context.
  • Does it work when run on your machine?
  • Is it clear what the code is doing?
  • Do the commit messages explain why the changes were made?
  • Are there all the unit tests needed?
  • Has all relevant documentation been updated?

@lfdebrux
Add uniqueness validation for access tokens
b62d605 
We could end up with weird behaviour if the same access token digest is
present twice in the database.
@lfdebrux
Add prefix to API access tokens
a7eb582 
It is considered good practice to add a prefix to API keys so that they
are easier to identify [[1], [2]], both for humans and machines.

[1]: https://github.blog/2021-04-05-behind-githubs-new-authentication-token-formats/
[2]: https://tailscale.com/kb/1277/key-prefixes
@lfdebrux lfdebrux changed the title API Token tweaks API token tweaks Dec 15, 2023
@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Passed Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

DavidBiddle
DavidBiddle approved these changes Dec 15, 2023
View reviewed changes
Copy link
Contributor

@DavidBiddle DavidBiddle left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice, think both of these changes make sense. I like the fact the test allows for the digest to be the same, I'd never have thought of that!

@aliuk2012
Copy link
Contributor

Hi @lfdebrux Can I double check why this is needed? Have we introduced some way for devs to insert their own generated token? I'm asking because originally the idea was that the model would control the value of the token digest being generated so in theory there should never have been duplicate token digests

@lfdebrux
Copy link
Member Author

Hi @lfdebrux Can I double check why this is needed? Have we introduced some way for devs to insert their own generated token? I'm asking because originally the idea was that the model would control the value of the token digest being generated so in theory there should never have been duplicate token digests

Yes, see #368

@aliuk2012
Copy link
Contributor

thanks @lfdebrux I've posted a message about allowing devs to use whatever token they like,

@lfdebrux lfdebrux marked this pull request as draft December 18, 2023 11:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@DavidBiddle DavidBiddle DavidBiddle approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@lfdebrux @aliuk2012 @DavidBiddle