-
Notifications
You must be signed in to change notification settings - Fork 3
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Authentication API #20
Comments
arteevraina
added a commit
to arteevraina/registry
that referenced
this issue
Apr 9, 2023
feat: API security features + add maintainers
Cargo does it the same way. The token cannot be guessed and should obviously not be shared by the user. It also has a limited lifetime. There I'd say that it does the job for now. We can add a proper login in the future. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
In the registry server, we are following a token based Authentication, in which if the token is valid and belongs to a particular user in the database, we allow the user to access the API atleast.
But, it has it's downsides as well. For example, if a person has the valid token, they can send in request from any client and if the data is correct then API will perform it's task accordingly.
We can discuss the better approaches to perform authentication in this issue.
cc: @henilp105 @minhqdao @perazz
The text was updated successfully, but these errors were encountered: