LoginAndSecurity - Revision history

GearyEppley at 01:27, 25 May 2020

2020-05-25T01:27:47Z

GearyEppley at 01:20, 25 May 2020

2020-05-25T01:20:30Z

GearyEppley at 01:18, 25 May 2020

2020-05-25T01:18:25Z

DaveSanderman: /* Todo */

2020-03-31T14:06:48Z

Todo

DaveSanderman at 13:56, 31 March 2020

2020-03-31T13:56:10Z

DaveSanderman at 17:13, 30 March 2020

2020-03-30T17:13:01Z

DaveSanderman at 22:06, 20 March 2020

2020-03-20T22:06:13Z

DaveSanderman: Created page with "== Login and Security == We need to build a login and security system to support future enhancements to the site. It must support the Single-Page Application model used by t..."

2020-03-20T21:59:38Z

Created page with "== Login and Security == We need to build a login and security system to support future enhancements to the site. It must support the Single-Page Application model used by t..."

New page

== Login and Security ==

We need to build a login and security system to support future enhancements to the site. It must support the Single-Page Application model used by the new React-based front-end UI.

=== Requirements ===

* Anonymous users can use the main site and cannot access any sensitive information
* Users can sign up for accounts and manage their own data:
** Profile info (e.g. change email, change password)
** Notifications
** Favorite gages?
* Users can log in using credentials from third-party authenticators (e.g. Facebook, Google)
** The email address associated with the third party account will be the email address we use for them
* Standard login/logout functionality
** If a user selects logout, their browser must not be able to access their account (this is a potential issue with JWT depending on how the tokens are managed/stored)
** Reasonable "Remember Me" timespan -- No requirement to re-login if the account has been accessed within one week?
* Users can be granted various levels of administrative access.
** If possible, existing ASP.NET infrastructure (e.g. Role-based authentication via attribute decoration) should be usable for restricting access
* Revoking administrative access (or any other specialized rights) must take effect quickly (if not immediately).
* UI must have a simple way to know whether a given option (e.g. "Edit Gage Data") is available to the current user.

==== Possible Requirements ====

* Support multiple organizations and/or regions within a single database (e.g. run Snoqualmie Valley and Bellevue gage networks from the same database).
** The alternative is simply to instantiate multiple sites (database, website, backend jobs). This potentially gives better granularity for budgeting/billing.
* Only a single login event is required to use both the old Admin site and the new UI
** The alternative is just to require two separate logins; with "Remember Me", this may not be that much of a problem. Eventually, we hope to migrate all the Admin functionality to the new UI, so this is possibly a short-term issue.

==== Explicit Non-Requirements ====

* None?

=== Open Questions ===

Feature design questions:
* ‽ What are the details about login timeouts with and without "remember me"?
* ‽ Do we need to think about anything like two-factor auth?
* ‽ Do we need to provide a "Remove my account" feature?
* ‽ How are email addresses handled when a user does "Login with Facebook"? Can they change their email address on our system? Do we get an email address for them from Facebook?

Code design questions:
* ‽ Do we need to worry about JWT tokens being stolen?
** "Logout" can't directly invalidate a JWT token unless we store a list of invalid tokens

=== Building Blocks ===

@@ Line 146: / Line 146: @@
   |         Name: {name}             <-- Can't change name or email
   |        Email: {email}
-−
+ |
   |        Phone: [________________] (optional)
+  |

@@ Line 78: / Line 78: @@
 * Create Account
   +------------------------------------
   |         Name: [________________]
   |        Email: [________________]
@@ Line 93: / Line 95: @@
 * Login
   +------------------------------------
+ | Login
   |           Email: [________________]
   |        Password: [________________]
@@ Line 104: / Line 107: @@
 * Forgot password form
   +------------------------------------
+  | Reset Password
-  |           Email: [________________]
+  |
   |             [ submit ]
@@ Line 124: / Line 128: @@
 * Edit Profile (direct user)
   +------------------------------------
   |         Name: [________________]
   |        Email: [________________]
@@ Line 135: / Line 141: @@
 * Edit Profile (social linked user)
   +------------------------------------
   | Linked to Facebook|Google account:
   |         Name: {name}             <-- Can't change name or email
   |        Email: {email}
   |        Phone: [________________] (optional)
+  |

@@ Line 10: / Line 10: @@
 ** Profile info (e.g. change email, change password)
 ** Notifications
-** Favorite gages?
+** Favorite gages - "Watch list"
 * Users can log in using credentials from third-party authenticators (e.g. Facebook, Google)
 ** The email address associated with the third party account will be the email address we use for them
 * Standard login/logout functionality
 ** If a user selects logout, their browser must not be able to access their account (this is a potential issue with JWT depending on how the tokens are managed/stored)
-** Reasonable "Remember Me" timespan -- No requirement to re-login if the account has been accessed within one week?
+** "Remember Me"
 * Users can be granted various levels of administrative access.
 ** If possible, existing ASP.NET infrastructure (e.g. Role-based authentication via attribute decoration) should be usable for restricting access
@@ Line 35: / Line 38: @@
 Feature design questions:
-* {{XQ}} What are the details about login timeouts with and without "remember me"?
+* {{XQ}} <s>What are the details about login timeouts with and without "remember me"? </s>
-* {{XQ}} What are our password requirements
+** Details above
-* {{XQ}} Do we need to think about anything like two-factor auth?  Email address validation?
+* {{XQ}} <s>What are our password requirements?</s>
-* {{XQ}} Do we need to provide a "Remove my account" feature?
+** A: 8 chars
 * {{XQ}} How are email addresses handled when a user does "Login with Facebook"?  Can they change their email address on our system?
+** A: If they provide a password then they can change email address, but then no longer linked to Facebook until Facebook email address also changes(email address is link)
 === Todo ===
@@ Line 49: / Line 56: @@
 * Login dialog styling
 * Add Login-With-Facebook
-* Add Login-With-Microsoft?
+* Add Login-With-Microsoft (P2)
 * Build and style Create-an-account dialog
 ** Password strength validation & feedback
 ** Captcha?
 * Build and style Edit-profile dialog (if nothing else, we need to let users change their email addresses)

@@ Line 46: / Line 46: @@
 via Google. This is what else needs to be done in order to fully implement the feature:
 * Login dialog styling
 * Add Login-With-Facebook

@@ Line 1: / Line 1: @@
 == Login and Security ==
@@ Line 35: / Line 36: @@
 Feature design questions:
 * {{XQ}} What are the details about login timeouts with and without "remember me"?
-* {{XQ}} Do we need to think about anything like two-factor auth?
+* {{XQ}} What are our password requirements
 * {{XQ}} Do we need to provide a "Remove my account" feature?
-* {{XQ}} How are email addresses handled when a user does "Login with Facebook"?  Can they change their email address on our system?  Do we get an email address for them from Facebook?
+* {{XQ}} How are email addresses handled when a user does "Login with Facebook"?  Can they change their email address on our system?
-Code design questions:
+=== Todo ===
-=== Building Blocks ===
+There is a proof-of-concept feature in place currently which uses JWTs and supports login

@@ Line 34: / Line 34: @@
 Feature design questions:
-* ‽ What are the details about login timeouts with and without "remember me"?
+* What are the details about login timeouts with and without "remember me"?
-* ‽ Do we need to think about anything like two-factor auth?
+* Do we need to think about anything like two-factor auth?
-* ‽ Do we need to provide a "Remove my account" feature?
+* Do we need to provide a "Remove my account" feature?
-* ‽ How are email addresses handled when a user does "Login with Facebook"?  Can they change their email address on our system?  Do we get an email address for them from Facebook?
+* How are email addresses handled when a user does "Login with Facebook"?  Can they change their email address on our system?  Do we get an email address for them from Facebook?
 Code design questions:
-* ‽ Do we need to worry about JWT tokens being stolen?
+* Do we need to worry about JWT tokens being stolen?
 ** "Logout" can't directly invalidate a JWT token unless we store a list of invalid tokens
 === Building Blocks ===