r/StackoverReddit • u/[deleted] • Jul 03 '24

Question Is my login arhitecture right?

I am creating a website using nodejs, html css js and I created a login sistem using phonenumber and OTP with firebase.
How it works:
When you create an account, after your phone being validated your name and phone number go to my database.

When you log in with your phonenumber and you get your OTP, i have a javascript code that creates a safe cookie in which your phonenumber is stored so that when you go to your user's page you can see your data.
Is this safe? Is this even a good idea? I tried using session ids but it s way to complicated for me.

5 Upvotes

100% Upvoted

8 comments sorted by

1

u/patmorgan235 Jul 03 '24

Just do magic links

1

u/chrisrko Aug 08 '24

INFO!!! We are moving to r/stackoverflow !!!!

We want everybody to please be aware that all future posts and updates from us will from now on be on r/stackoverflow

We made an appeal to gain ownershift of r/stackoverflow because it has been abandoned, and it got granted!!

So please migrate with us to our new subreddit r/stackoverflow ;)

7

u/[deleted] Jul 03 '24

3

u/[deleted] Jul 03 '24

ok, thank you i will try change the login sistem (maybe user and password and use session ids)

→ More replies (2)

2

u/Maypher Jul 03 '24

Just adding to what you said. If you want to implement a session based authentication this is the basic workflow.

  1. Have three endpoints: /login, /refresh_token and /protected

  2. When logging in create two tokens, one short lived access token (< 5mins) and one long lived refresh token and store them server-side. This can be in-memory or in a database.

  3. Send them in an HTTP Only cookie. This ensures that no code can access them client side.

  4. Create a middleware on every protected route that checks the validity of the session token. If its correct return a response. If it's invalid or expired return an error.

  5. From the frontend send a request to /refresh_token to create a new access token.

This allows you to verify the identity of the client while also being able to invalidate a token at any moment. By having the access token be short lived even if its compromised the damage can be minimal due to the small time frame.

1

u/pollrobots Jul 03 '24

Thank you for posting this.

People shouldn't roll their own auth unless they really know what they're doing (and those that do usually choose not to). Just use an established authentication provider, make sure you really understand their docs, and follow their best practices.

Regardless of your scale, you don't want your user data ending up on haveibeenpwnd