Token security

[detronetdip]

I am rewriting the token storage and validation logic in a more secure way.

Fixes #9

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

[anomic30]

Can you explain this?

[detronetdip]

mentioning withCredentials:true will ensure that the cookies are sent to the server with every request.

[anomic30]

Explain this

[detronetdip]

Remember I commented the window.localStorage.setItem("didToken", newDidToken); well I did that for this. This is setting the token ass httpOnly cookie in the response header so whenever client receives this response , client will automatically save the token in the browser cookie and I have passed httpOnly:true because by mentioning this it will ensure that it will not be accessible from client javascript.

[anomic30]

We need to store the didToken in the cookie storage.

[detronetdip]

Yes and we are doing that. window.localStorage.setItem("didToken", newDidToken); will save the token in the local storage but we want to store the token in the cookies. So I am sending the token to the server and when response comes back it will automatically set the token in the cookis.

[detronetdip]

@anomic30 can you please tell me why the below code is returning null.

var d=await magic.auth.loginWithMagicLink({
        email,
});
console.log(d);

[detronetdip]

@anomic30 please help me I could not understand why it is returning null.