maierfelix / maierfelix/POGOserver
[FEAT REQ] Change logic behind player authentication/identification
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 476
- Forks
- 198
- PR merge metrics
- No merged PRs in 30d
Description
Posting this since I haven't had the free time to catch up on ES6 and fully work through the application workflow. (And because I saw commits 33cca65938cb0f7ae5648ab6f9157e7c8d860288 and 4fdaf71998481ea574ef97eafc7d9752021c3a34 copying in my `CLAIM_CODENAME` test files)
Current serverside logic depends on the IP for user identification. This runs into issues when there are multiple players sharing a single internet connection(Home wifi/Hot spot/etc), or the server is put behind a reverse proxy or load balancer for scaling. This also means that a user logging in/out between multiple accounts in the client-side app doesn't actually change anything.
This seems to be enforced by the server checking who the client is(IP) before actually performing any protobuf breakdown. (Or I'm really lost trying to go through the ES6 workflow) (https://github.com/maierfelix/POGOserver/blob/master/src/models/World/players.js#L25)
As far as my research and testing, the `auth_ticket` object is actually just echo'd back at the server by the client, with almost no validation or checking client-side. At most, when the `expire_timestamp_ms` variable expires, the client will attempt a reauth.
From my own experiments, I treat the 3 `auth_ticket` variables as:
```
start: new Buffer(player.email),
expire_timestamp_ms: ((new Date).getTime() + (1000 * 60 * 30)),
end: new Buffer(),
```
With `session key` either being the index/hash value from a sessions table(Requires DB table), or a server-signed JWT to confirm that the entire `auth_ticket` object is valid(Doesn't require a DB table).
This should allow the server to properly use the `auth_ticket` object like a standard session token.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with src/models/World/players.js at line 25 and trace the server-side player identification and protobuf workflow. Review how auth_ticket is echoed and how the client handles expire_timestamp_ms. Done means authentication no longer depends on client IP, supports multiple players behind shared connections or proxies, and changes when users switch accounts.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- authentication, backend
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100