Add fast-token validation feature #15

Activity

1. j12y commented on Nov 30, 2017

   

   j12y

   on Nov 30, 2017

   Member

   More actions

   Can you explain what fast-token is/does that you are looking for?

   The predix.security.uaa module should already be checking the expiration on the token so only when it expires or is rejected would a new token be requested. There may be a nuance though I'm missing and should be incorporated.

   Thanks!
2. j12y

   self-assigned this

   on Nov 30, 2017
3. j12y

   added

   waiting for feedback

   on Nov 30, 2017
4. akshayeshenoi commented on Dec 1, 2017

   

   akshayeshenoi

   on Dec 1, 2017

   Author

   More actions

   Fast Token deals with API security primarily.

   Incoming API requests should have an Authorization: bearer token in their headers. The app should then use this token to verify if it is in fact valid. Traditionally, this is done by making a request to the UAA instance, which adds to the overall latency.

   Fast Token validation essentially checks the incoming client-token's validity locally. All it needs is your UAA's public key (for which it needs to make one request). It then decodes the JWT and verifies its integrity using the public key we fetched [read more].

   Say, for a flask app:

    @app.route('/hello')
    def hello():
        if uaa.authenticateRequest(request) is false: return 'Forbidden'
        return 'Hello, World'

   There is a JS implementation in this org as well.
5. j12y

   added

   feature

   and removed

   waiting for feedback

   on Jan 29, 2018
6. j12y

   added

   help wanted

   on Mar 21, 2018
7. j12y

   removed their assignment

   on Apr 6, 2018