Roundup Tracker - Issues

Issue 2551064

Title: Grab bag of other thoughts on JWT credentials
Type: rfe Severity: normal
Components: Versions:
Status: new Resolution:
Dependencies: Superseder:
Assigned To: Nosy List: rouilj
Priority: low Keywords:

Created on 2019-10-06 22:11 by rouilj, last changed 2019-10-26 16:53 by rouilj.

msg6698 Author: [hidden] (rouilj) Date: 2019-10-06 22:11
With 2.0 we have minimal suport for json web tokens. They allow login
as a user and a restricted permissions set based on the role embedded
in the JWT.

This ticket can be used as a grab bag of ideas that others may want to
tackle if JWT's are deemed more useful.

JWT can have own rate limit

Currently rate limiting in the rest interface is done based on the
user/subject. Consider adding a separate rate limit in the body of the
JWT. This restricts the amount of resources usable by the JWT which
may be lower than that allowed for the user. The user's level needs to
be able to support say an AJAX web interface to roundup which may
need many more hits than the JWT token needs to do its work.

More ideas can be added to this ticket and migrated to separate
tickets as they get implemented.
msg6777 Author: [hidden] (rouilj) Date: 2019-10-26 16:53
Consider including array of ip's (or cdir network spec) in token.
Token can only be used if sent from an ip in the list.

X-Forwarded-For is available from roundup-server, so it may be
possible to get the real source ip in other deployment modes.
Date User Action Args
2019-10-26 16:53:29rouiljsetmessages: + msg6777
2019-10-11 02:34:43rouiljsetpriority: low
type: rfe
2019-10-06 22:11:50rouiljcreate