lynndylanhurley / lynndylanhurley/devise_token_auth
Question about security.
Nobody has claimed this yet.
- Dominant language
- Ruby
- Stars
- 3.6k
- Forks
- 1.1k
- PR merge metrics
- No merged PRs in 30d
Description
I'm new to Rails and I don't understand how to use access_token.
When the user resets the password ( /auth/password/ ), the access_token parameter goes by the url, right? Is this safe? In the url anyone with malicious intent could get the access_token, change the user's password and enter the system, am I wrong?
In the case of the system I am developing, security is very important as it is a fintech that will deal with the user's money.
I'm sorry if this is a silly question, but I really don't understand and I'm afraid the security will fail.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Begin with the /auth/password/ reset flow and the access_token URL parameter described in the report. Confirm the security behavior and document a clear answer explaining whether the described flow is safe and what users should verify.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rails, ruby
- Domain
- api, authentication, security
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100