Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove authn-strategy extensibility in future versions and simplify API #54

Open
dlongley opened this issue Dec 26, 2022 · 0 comments
Open

Comments

@dlongley
Copy link
Member

Creating many different authn strategies is an anti-pattern to be avoided. Ideally, applications either only use capabilities (e.g., zcaps / some form of OAuth2) or they use simple authn (multifactor) to establish sessions that can then be used to invoke capabilities or use access tokens via OAuth2.

Therefore, this module should simplified to only support session-based authn (and see #53 for CSRF-protections). Support is still required for the strategies (tokens + multifactor) used in bedrock-authn-token-http, so simplification should consider this. Perhaps this module should even just be merged with bedrock-authn-token-http.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant