goauthentik / goauthentik/authentik
Enforce the security for payload at login stage
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 644
Description
**Is your feature request related to a problem? Please describe.**
Not really, except if authentik would be compliant with:
- Payment Card Industry [Data Security Standard](https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf) `PCI DSS` (cf. https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard)
- GDPR (cf. https://thecyphere.com/blog/gdpr-encryption/)
- FIPS 140.2 140.3 (cf. https://csrc.nist.gov/pubs/fips/140-3/final)
- Any business security regulations requiring end-to-end http payload encryption
**Describe the solution you'd like**
In order to do not rely only on the TLS transport security mechanism, because the man in the middle could inspect the traffic and retreive many information about the user in clear text, it's interresting to put in place an encryption protocol on all sensitive data sent within HTTP request / response payloads at login stage, such as username or password.
Well known protocols are:
- `Secure Remote Password` (SRP-6a) _(cf. https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol)_
- `JSON Web Encryption` (JWE) _(cf. https://en.wikipedia.org/wiki/JSON_Web_Encryption)_
Target components should be the following.
| Component | Property value to be encrypted | Notes |
| --- | --- | --- |
| ak-stage-identification | uid_field | The value could be the username, email, user identifier.
| ak-stage-password | password | |
| ak-stage-authenticator-validate | code | TOTP code |
**Describe alternatives you've considered**
N/A
**Additional context**
Language implementations
| Protocol | Python | Go | JavaScript |
| --- | --- | --- | --- |
| SRP-6a | https://pythonhosted.org/srp/srp.html#module-srp | https://github.com/opencoff/go-srp | https://www.npmjs.com/package/fast-srp-hap |
| JWE | https://jose.authlib.org/en/dev/guide/jwe/ | https://github.com/golang-jwt/jwe | https://github.com/panva/jose?tab=readme-ov-file#json-web-encryption-jwe |
Contributor guide
Assessment
This issue has not been assessed yet.