The User IP added to the JWT token's payload. In addition, the IP is … #33
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…encrypted, so as it go back to user browser it will not be exposes.
Hitansh159
approved these changes
Apr 21, 2023
| if (decryptedIP !== req.ip) { | ||
| res.status(403) | ||
| res.send({err:"Unauthorized"}); | ||
| } | ||
|
|
There was a problem hiding this comment.
add user to details to request when IP matches
req.user= payload
|
I see that you make development branch to be base branch. |
# Conflicts: # controller/auth.js # util.js
|
@TejasNair9977 |
|
Thanks for Contributing |
Closed
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
@ Hitansh159
The User IP added to the JWT token's payload. In addition, the IP is encrypted, so as it go back to user browser it will not be exposes.
I change 3 files:
In Util - added encryption and decryption functions to encrypt/decrypt IP (can be use for other things then IP too).
And added the encryption function to generateToken function to create encrypted IP, and add the encrypted IP to JWT payload.
Fix typo from genrateToken() {} to gen(e)rateToken() {}.
In controllers/auth.js - add req.ip as generateToken argument.
In middleware/auth.js - I change the JWT verify to be inside try catch and added the logic of the IP decryption, and the compare it with the current req.ip of this req in order to approve that the req came from the token owner and from the same machine.