About security and user roles

[tappbell]

Hello,
I'm using react-native and I see that authSecret is required to be on the config.
This means that someone who download my app can steal the authSecret through finding the javascript bundle in the app.
How are you managing this thing?

Thank you!

[ccvlad]

Hi, @tappbell

In this case you are able to configure a small server that stores the config and creates session for user who want to login.

1. Create the server (you can use ConnectyCube JS SDK to make a NodeJS server/service);
2. On the server receive user data, log-in/sign-in and send a ConnectyCube session token back;
3. Initialize the ConnectyCube SDK via the session token on the client side - https://developers.connectycube.com/js/?id=initialize-with-existing-token.

[tappbell]

Hi, thank you for your response.

I have a couple of questions regarding token. The doc says that the token expires after 2 hours of inactivity. The refresh should be done manually, right? https://developers.connectycube.com/js/authentication-and-users?id=session-expiration. So, in the case you mention, that refresh should be done again server side to retrieve a new token. Is this the way to proceed?

And one last thing: I figured out that using Application session token I can signup new users, and also using the User session token. Is there anyway to deny the signup for User session token? Thinking about a logged user may be able to create infinite new profiles... I guess this means to have some kind of "user roles" or at least a server side admin token vs a only user basic token.

Thank you very much!

[ccvlad]

I have a couple of questions regarding token. The doc says that the token expires after 2 hours of inactivity. The refresh should be done manually, right? https://developers.connectycube.com/js/authentication-and-users?id=session-expiration. So, in the case you mention, that refresh should be done again server side to retrieve a new token. Is this the way to proceed?

We do not have refresh token. You should reuse user data to create a new session after the old session was expired.

And one last thing: I figured out that using Application session token I can signup new users, and also using the User session token. Is there anyway to deny the signup for User session token? Thinking about a logged user may be able to create infinite new profiles... I guess this means to have some kind of "user roles" or at least a server side admin token vs a only user basic token.

You are right that user can creates profiles. We do not have an API to block the ability. It is common user registration and you can prevent the ability just on front-end side.