OEP-42 and XBlock authentication

To Do item, post discussion:

As per the comment https://github.com/openedx/open-edx-proposals/issues/489#issuecomment-2123103869,

This may be another case where we just note in the OEP that XBlock authentication is not under development (or however you want to put it), and point to this ticket for more details.

So whomever is picking up this task, please add this note appropriately, point to this ticket, and update the OEP changelog. Thanks!

Original ticket description

Minor context: I just learned (or re-learned) about XBlock secure tokens used for authentication, implemented in the XBlock utils here. Note: this is old enough that for all I know I took part in reviews and just don't remember.

Here are some assorted thoughts related to this, that may or may not result in different tickets:

• At a minimum, we should update OEP-42 on Authentication to point to the best docs around XBlock authentication. This OEP is used in part as an index page to other authentication documentation about how AuthN works in edx-platform.
• I did not see an ADR around this decision. It is possible that someone could retroactively create an ADR that we point to. Otherwise, we could point to docstrings like the one linked above in the implementation.
  • There seems to have been discussion somewhere around these tokens living for 2-4 days, and it would be great to capture some of that discussion and alternatives discussed, etc.
• Related, I sort of thought we had an undocumented semi-made decision to no longer user secret keys in general, and instead rely on asymmetrically signed JWTs to improve security and potential key rotation. Maybe this solution isn't sharing the secret key, so it doesn't matter? If there were an ADR, it would be interesting to see this discussed. Also, does this warrant a separate ticket and possibly a separate OEP around shared secret keys?