goauthentik / goauthentik/authentik

Enforce the security for payload at login stage

Open
#7,961 2 comments 0 reactions 0 assignees View on GitHub
enhancement enhancement/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 1h
Merged PRs (30d)
644

Description

**Is your feature request related to a problem? Please describe.**
Not really, except if authentik would be compliant with:
- Payment Card Industry [Data Security Standard](https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf) `PCI DSS` (cf. https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard)
- GDPR (cf. https://thecyphere.com/blog/gdpr-encryption/)
- FIPS 140.2 140.3 (cf. https://csrc.nist.gov/pubs/fips/140-3/final)
- Any business security regulations requiring end-to-end http payload encryption

**Describe the solution you'd like**
In order to do not rely only on the TLS transport security mechanism, because the man in the middle could inspect the traffic and retreive many information about the user in clear text, it's interresting to put in place an encryption protocol on all sensitive data sent within HTTP request / response payloads at login stage, such as username or password.

Well known protocols are:

- `Secure Remote Password` (SRP-6a) _(cf. https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol)_
- `JSON Web Encryption` (JWE) _(cf. https://en.wikipedia.org/wiki/JSON_Web_Encryption)_

Target components should be the following.
| Component | Property value to be encrypted | Notes |
| --- | --- | --- |
| ak-stage-identification | uid_field | The value could be the username, email, user identifier.
| ak-stage-password | password | |
| ak-stage-authenticator-validate | code | TOTP code |

**Describe alternatives you've considered**
N/A

**Additional context**

Language implementations
| Protocol | Python | Go | JavaScript |
| --- | --- | --- | --- |
| SRP-6a | https://pythonhosted.org/srp/srp.html#module-srp | https://github.com/opencoff/go-srp | https://www.npmjs.com/package/fast-srp-hap |
| JWE | https://jose.authlib.org/en/dev/guide/jwe/ | https://github.com/golang-jwt/jwe | https://github.com/panva/jose?tab=readme-ov-file#json-web-encryption-jwe |

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.