auth to-do list

[jameshadfield]

For prototype

• JWT expiry
• decode JWT in client to get username
• a development flag to ignore authentication (!)
• test JWT
• set up protected S3 URL for data & access from server
• remove delete token button on login page
• changing password doesn't revoke JWTs, so a user is still authenticated
• incorrect username/passwords remain filled in after failure
• show spinner (e.g.) after clicking "login"

For real usage

• login rate limiting & max retries
• ability to revoke JWTs & client check JWT hasn't been revoked
• store hashed passwords (server) -- see note in server/auth.js
• user db or similar

[tsibley]

It might make more sense to delegate authentication to an external service instead of building it ourselves. There are several we could use, e.g. Auth0.

[jameshadfield]

Could do. Passportjs and Auth0 work well together.

[jameshadfield]

Auth for prototype (discuss)