0

I am building a web app, which uses a backend WebApi (requiring authorized users). The system simply stores some input from the user similar to a post on facebook.

  1. The front end (Angular) allows only social/external auth.
  2. My backend can then use JWT Middleware to check that their JWT is valid for every request.
  3. Assume my scopes are set correctly to always get the email claim.

So my question is, do I even need to register the user anymore?! I know this sounds crazy, but from now, isn't it just fine to let the user create posts in my system, and use their email address as the UserId? Am I missing something?

| improve this question | |
  • Just wondering whether you'll also get the email if it's not verified. Because if you do, I could register to one of the social sites with your email, and then use that account to login to your account. So it's probably not good idea to use email as identification, use whatever userID the social site provides and don't allow users with the same id from other social platform access the account. – FINDarkside May 28 '18 at 14:58
  • Hmm, I thought about this too. This is to do with account merging and it's a difficult bit. But I found that Firebase merges accounts based on email anyway, so that led me to think that email was good enough – Worthy7 May 29 '18 at 0:07
1

This question could be interpreted many different ways:

should my Database use a non-root user

Yes, you should create a non-root user (one for each unique app accessing the database to prevent your wordpress-db-user (do to some random wordpress exploit that comes out in the future) from having full access to your super-fancy-custom-web-apps-db and getting a full list of all of your users emails that you have been collecting.

should I create a user's table in my databse

Authentication or no ... this is kinda a no-brainer. If you want to be able to link johndoe@qmail.com to his preferred alias super happy fun guy ... or one of your users decides that qmail sucks and they want to change there accounts email to johndoe@qahoo.com ... a users table with an internal UUID per user might be very useful.

do I need to store user-password-hashes for login

Yes and no ... putting full faith in some other websites authentication might save you from having to worry about having your local db hacked and having to report that a few thousand of your user's password hashes are out in the wild. But at the same time, if a vulnerability is found in this third party's authentication it could very well leave you in a worse situation since you have no control over the third party patching it ... and nothing to fall back on if this third party decides to charge for this auth service or just discontinue it all together.

This is more of a business decision than a security decision ... there are lots of pros and cons of going each way.

| improve this answer | |
  • Ok, I guess my question was more about point 3. I'm going to have null passwords for external login until a user decides to set a custom one for my site. – Worthy7 May 28 '18 at 3:48
  • just make damn sure someone cant bypass login by using said null password ... seems obvious, but could be disastrous if its an oversite – CaffeineAddiction May 28 '18 at 3:55
  • lol of course. :-) – Worthy7 May 28 '18 at 4:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.