New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OAuth #47

Open

itsumura-h opened this issue Mar 29, 2020 · 0 comments

Owner

itsumura-h commented Mar 29, 2020 •

edited

https://github.com/CORDEA/oauth

JWTは使うべきではない　〜 SPAにおける本当にセキュアな認証方式〜
SPAのログイン認証のベストプラクティスがわからなかったのでわりと網羅的に研究してみた〜JWT or Session どっち？〜

種類	ダメな理由
JWT	自ドメイン以外のJSから呼ばれてしまう

SPA + Rails API 構成におけるcookie + session認証

SignIn

get /api/signin
check Email and Password
OK =>
- セッション作成 and login
- return 200 with cookie
Fail =>
- Http400

middleware

cookieのsessionIdチェック

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment