Creating Sign up and login routes and controller

[udaymittal7]

I would like to work on creating the sign up and login routes and controller for this project as a participant of GSSOC'21.
Please assign this to me and add the relevant tags.

[abdus]

It would be great if we split this issue into two.

1. implement SignUp
2. implement SignIn

[Aryaman1706]

Hey @abdus ! I would love to work on this!

Ideas

• Multiple auth strategies like GitHub, Google, and email/phone number.
• We can use passport but if we want to inculcate more scopes then we can use API offered by respective platforms like google's people API gives a ton of information like phone number, birthday, organizations, etc (complete list here)
• We can maintain cookie sessions stored in a Redis store rather than in memory with proper secret and TTL.
• Appropriate email/phone number verification using some sort of mailing and SMS services like SendGrid or nodemailer.
• Restricting users from making too many unsuccessful attempts. We can do this either going way simple and using express-rate-limiter or we can go with the token bucket approach.
• Checking appropriate CSRF token with each login/signup request.

I would love to discuss it further.

[udaymittal7]

@abdus Yes, we can split it.
I am up for any of those.
Should I create different issues for them separately?
Someone else can take the other.

[abdus]

@Aryaman1706 thanks for the input. it helps!
@udaymittal7 sure. go ahead and split it into two issues. You can work on one and @Aryaman1706 may take the other.

[Manvityagi]

@udaymittal7 @Aryaman1706
Can you make two separate issues for and take one of them each?

[Manvityagi]

Hey @abdus ! I would love to work on this!

Ideas

• Multiple auth strategies like GitHub, Google, and email/phone number.
• We can use passport but if we want to inculcate more scopes then we can use API offered by respective platforms like google's people API gives a ton of information like phone number, birthday, organizations, etc (complete list here)
• We can maintain cookie sessions stored in a Redis store rather than in memory with proper secret and TTL.
• Appropriate email/phone number verification using some sort of mailing and SMS services like SendGrid or nodemailer.
• Restricting users from making too many unsuccessful attempts. We can do this either going way simple and using express-rate-limiter or we can go with the token bucket approach.
• Checking appropriate CSRF token with each login/signup request.

I would love to discuss it further.

Let's start with Google Oauth for this issue, will extend it further for github etc @Aryaman1706

CC: @abdus

[rohithmsr]

What are all the things I must work on? There are so many issues given in this single issue
@abdus @Manvityagi

[Manvityagi]

What are all the things I must work on? There are so many issues given in this single issue
@abdus @Manvityagi

Hi @rohithmsr #33 is taking care of this issue, left it opened mistakenly.