Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Competing Authentication Tokens when using multiple devices #197

Open
t16n opened this issue Aug 3, 2023 · 1 comment
Open

Competing Authentication Tokens when using multiple devices #197

t16n opened this issue Aug 3, 2023 · 1 comment
Assignees
Labels
bug Something isn't working drf-oauth2 good first issue Good for newcomers

Comments

@t16n
Copy link
Contributor

t16n commented Aug 3, 2023

Describe the bug
When using Django Authentication currently with the /convert-token route across multiple devices, it's leading to an unexpected behavior of sharing authentication tokens. If one device revokes or refreshes the token, all other devices are put out of sync and cease to function properly.

To Reproduce
Steps to reproduce the behavior:

  1. Start the authentication process on one device.
  2. Use the same credentials to start the authentication process on another device.
  3. Notice that the same token is being shared across multiple devices.
  4. Refresh or revoke the token on one device.
  5. See that other devices are now out of sync and not working properly.

Expected behavior
When Django Authentication is used on multiple devices, each device should have its unique token, even if the existing token is still valid. Also, when a token is revoked or refreshed in one device, it should not affect the functionality in other devices.

Screenshots
Screenshot 2023-08-03 at 11 04 14

Desktop (please complete the following information):

  • OS: All
  • Browser: All
  • Version: All

Smartphone (please complete the following information):

  • Device: All
  • OS: All
  • Browser: All
  • Version: All

Additional context
A suggested fix could be that we should probably generate new tokens each time the create_token_response function is invoked. This should potentially ensure that every device has its own unique token, preventing overlap and reducing the risk of devices going out of sync.

@wagnerdelima
Copy link
Owner

I believe I can work on this issue this month still.

@wagnerdelima wagnerdelima self-assigned this Sep 18, 2023
@wagnerdelima wagnerdelima added bug Something isn't working good first issue Good for newcomers drf-oauth2 labels Sep 18, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working drf-oauth2 good first issue Good for newcomers
Projects
Status: In Progress
Development

No branches or pull requests

2 participants