I mean your backend library.

"supertokens-website": "^3.2.9" and "supertokens-node-postgres-ref-jwt": "^3.0.1",

Alright. Give me 2 mins please

Are you using axios or fetch?

And I assume when a user is logged in, this work normally?

Things*

my boss just walked in, gonna be back in a bit

Ok

hey there, I am very thankful that you guys wrote these articles: https://medium.com/hackernoon/all-you-need-to-know-about-user-session-security-ee5245e6bdad and https://medium.com/hackernoon/the-best-way-to-securely-manage-user-sessions-91f27eeef460#e81c They really helped me to gather a better understanding on session management. Now, I would like to try that out on my own Node.js project. It will be a non-commercial student project and only for my educational purpose. I know that you have your own library which would make things a lot easier for me. However, for the sake of a maximum learn-effect, I would like to take the hard-way and implement session security measures myself (yup, I know I'm being silly here... let's say I try to enforce decent security measures for my JWT's assuming that Anonymous & Co. ain't coming for my database & server 😂 ). Am I allowed to ask some of you token-gods for help if I have a question regarding some of the concepts?

hey! sure.. i'll try and answer them when I can.

thanks a lot rp 🙂

The refreshkeys should be encrypted in the database right? (i would use bcrypt for that)

Hashed. Not encrypted

oh okay thanks. But bcrypt is the right tool to do that, right?

Yea. That could work! U could use crypto too. But use SHA256 at a minimum

Isn't that the default for bcrypt anyways?

Not sure if it’s the default.. but that you could see for yourself in their docs

okay thanks 🙂

Ur welcome

Everytime I generate a token pair (access & refresh), I store them in the database. As per your advice from the blog entry, I would like to delete (revoke) the old refresh token upon the first usage of the newly generated access token. How can I achieve this? Like, where do I store the old refreshToken so that I can delete the database entry upon the usage of the new one? My idea would be the following: Every token-pair is stored in a document that has it's _id field (which is unique). I could put the document id of the old token-pair into the payload of each of the newly generated tokens. If the client then proceeds to send a request with the new access token, I delete the old ones from the database, using the document id from the payload. if the client, for some reason, receives the new token pair and doesn't send a new request before the fresh access-token expires, it would use the generated refresh token to generate a new token pair. In that case, I would also delete the old ones from the database, using the document id from the payload. I know this is a very complex message, can you just tell me if this is somehow an acceptable way to approach my issue? @User

from what I understand, you are attempting to delete the old refresh token at the time the new one is issued. If this is correct, you will eventually run in problems where the old one is revoked and the new one doesn't reach the client (network issues...) and your user is logged out.

so solve this, you must delete the old one only when the new access token / refresh token is used.

exactly, that's what I'm trying to do as I pass the object-id (mongodb's document id) from the old token document as payload to the newly generated tokens. Only if the user uses one of the new tokens, the document of the old tokens will be deleted.

Is that reasonable to do or would you recommend a different approach?

yea. this is good!

Thanks so much 🙂

ur welcome.

with JWT, it would be detected if something on the token's payload is changed on client-side, right?

yea. cause they r signed.

would you recommend implementing something that prevents the user from having more than e.g. 2 active sessions?