Change the format of access tokens
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 668
- Forks
- 135
- Avg merge
- 4d 19h
- Merged PRs (30d)
- 7
Description
Our access tokens always start with `appToken-`. `appToken` is a generic term that doesn't tell what service the token belongs to. It'd be better for security scanning if it starts with the prefix that explicitly signifies it's for Central Dogma. For example, we could make our tokens start with `dogma`? We could do some research on the format of popular services' access tokens, such as [GitHub](https://github.blog/2021-04-05-behind-githubs-new-authentication-token-formats/).
Other changes we might want to introduce as well:
- Use `_` instead of `-`
- More entrophy
- Backward compatibility (i.e. allow using the old tokens)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked GitHub token-format reference, then locate Central Dogma's token generation and validation entry points. Compare prefix, separator, entropy, security-scanning, and backward-compatibility requirements before proposing a format. Done means the format and compatibility behavior are agreed and the implementation scope is documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100