{"action":"created","issue":{"url":"https://api.github.com/repos/fukamachi/caveman/issues/76","repository_url":"https://api.github.com/repos/fukamachi/caveman","labels_url":"https://api.github.com/repos/fukamachi/caveman/issues/76/labels{/name}","comments_url":"https://api.github.com/repos/fukamachi/caveman/issues/76/comments","events_url":"https://api.github.com/repos/fukamachi/caveman/issues/76/events","html_url":"https://github.com/fukamachi/caveman/issues/76","id":120532772,"number":76,"title":"Authentication module","user":{"login":"Immortalin","id":7126128,"avatar_url":"https://avatars.githubusercontent.com/u/7126128?v=3","gravatar_id":"","url":"https://api.github.com/users/Immortalin","html_url":"https://github.com/Immortalin","followers_url":"https://api.github.com/users/Immortalin/followers","following_url":"https://api.github.com/users/Immortalin/following{/other_user}","gists_url":"https://api.github.com/users/Immortalin/gists{/gist_id}","starred_url":"https://api.github.com/users/Immortalin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Immortalin/subscriptions","organizations_url":"https://api.github.com/users/Immortalin/orgs","repos_url":"https://api.github.com/users/Immortalin/repos","events_url":"https://api.github.com/users/Immortalin/events{/privacy}","received_events_url":"https://api.github.com/users/Immortalin/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2015-12-05T05:57:09Z","updated_at":"2016-07-01T12:13:13Z","closed_at":"2016-05-05T01:13:16Z","body":"Something like [devise](https://github.com/plataformatec/devise)"},"comment":{"url":"https://api.github.com/repos/fukamachi/caveman/issues/comments/229931348","html_url":"https://github.com/fukamachi/caveman/issues/76#issuecomment-229931348","issue_url":"https://api.github.com/repos/fukamachi/caveman/issues/76","id":229931348,"user":{"login":"tsili","id":7038777,"avatar_url":"https://avatars.githubusercontent.com/u/7038777?v=3","gravatar_id":"","url":"https://api.github.com/users/tsili","html_url":"https://github.com/tsili","followers_url":"https://api.github.com/users/tsili/followers","following_url":"https://api.github.com/users/tsili/following{/other_user}","gists_url":"https://api.github.com/users/tsili/gists{/gist_id}","starred_url":"https://api.github.com/users/tsili/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tsili/subscriptions","organizations_url":"https://api.github.com/users/tsili/orgs","repos_url":"https://api.github.com/users/tsili/repos","events_url":"https://api.github.com/users/tsili/events{/privacy}","received_events_url":"https://api.github.com/users/tsili/received_events","type":"User","site_admin":false},"created_at":"2016-07-01T12:13:13Z","updated_at":"2016-07-01T12:13:13Z","body":"Hi,\r\n\r\nDecided to give a little update here as we still have no public repository for it. We have made some of our design choices regarding our authentication and authorization modules and taken influence from the said `device` and also [OWASP](https://www.owasp.org/). We have decided to have the authentication to be as detached from authorization as possible to allow leeway in using multiple authentication mechanisms or dropping some out.\r\n\r\nWe are currently relying on postgres to handle the crypting and checking of passwords so the current method of authentication is through plain text POST requests that are passed to the database. This requires that all relevant traffic is https to prevent stealing of passwords. Also the algorithm used by default is bcrypt.\r\n\r\nOnce authenticated the user is added to the session that is accessed through a cookie, the user may start using they priviledges. The cookie is the standard session cookie set by caveman containing only the session id, all other data including the user assigned to the session is held on server. We will keep working to binding the session to the host with a little more than just the session id that could potentially be forged. Maybe IP binding per session.\r\n\r\nOn the authorization side, all actions are denied by default if this module is used. This includes even the reading of the application index page. You must then give each request at each route a permission to require for access, one or many. This is to prevent forgetting some routes without being assigned any restrictions even if they need them. This also means that even administrators won't be able to access everything unless you specifically say so. You may use the permission public to make public pages accessible to all.\r\n\r\nOn the license side, we might not be able to call it LAGPL as there seems to be some restrictions that we might need to add that make it override some of the original GPL. Mainly the changes we are planning include the exclusion of individual constants from being required to be disclosed as they may hold hard-coded passwords and other keys. Also the constants may not hold any functionality or perform actions, so no lambdas in there. this ensures that all code is covered.\r\n\r\nAlso we are planning to have even code compiled by an application licensed under this license to be subject to the license. This mainly affects dynamically loaded code and some DSLs, but some might see it as intrusive even then. We are planing to use the licensed software to not only make websites but also other software with web interfaces and so they might hold some code that the client may want to hold out of bounds of the license. With this that can only be done by holding the code internally and not showing it to customers. If they do without an NDA, the code is considered published and if it needs to be interpreted by the application, it is subject to this license. They also have to make their customer aware of this.\r\n\r\nFor these reasons we might call the license WGPL or Wisp General Public License rather than LAGPL. We still intend to keep it compatible so that software licensed under any GPL license is usable under this license.\r\n\r\nHope we can get the repository up soon so others can see what we are making."}}
{"actor":{"display_login":"tsili"}}