Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Revoke Access after a while(token expired)... #180

Open
windischb opened this issue Mar 15, 2017 · 4 comments
Open

Revoke Access after a while(token expired)... #180

windischb opened this issue Mar 15, 2017 · 4 comments

Comments

@windischb
Copy link

Hi!

I have successfully implemented a WampSessionAuthenticator.
As i understand the Authentication Process only happens when the connection open.
What about if my token expires 10 minutes after the connection is opened?
Is there any way to check the token on every request?

@darkl
Copy link
Member

darkl commented Mar 15, 2017

If you register your procedures with DiscloseCaller=true, you can access the AuthenticationId (the string set by your authenticator) by WampInvocationContext.Current.InvocationDetails.AuthenticationId. If you store somewhere the token used by the client to authenticate and mapped by your AuthenticationId, you can simply check if the token is still valid. The problem is that you'll need to do it in every procedure you register.

Elad

@darkl
Copy link
Member

darkl commented Mar 15, 2017

I have another idea - your authorizer can check if the token is valid in its CanXXX methods.

Elad

@windischb
Copy link
Author

That looks like a good Idea! I will try it this way!
Another point is, how to handle subscriptions...

The Client subscribe to a Topic, 5 minutes later the token expires.
Now the client cant call any Procedure, because the check in the CanXXX method returns false.
But what about the subscription?
Are the CanXXX methods also involved if a new item is submitted to the topic?

Maybe i can implement a "Rule"...
The Client have to send a Message every 30 seconds.
If the client doesn't send a Message or the token in this Method is expired, this client will be blacklisted until a new valid token is submitted?
Do you think that's a way which can work?

@darkl
Copy link
Member

darkl commented Mar 16, 2017 via email

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants