<div>
Hi Matthias, this is our biggest concerns to M7, we had some discussions about it with PicketBox team to improve it. Currently the token relies on PicketBox sessions like this:
</div><div><br></div><div><span style="color: rgb(51, 51, 51); font-family: Consolas, 'Liberation Mono', Courier, monospace; font-size: 11.818181991577148px; line-height: 14.545454025268555px; white-space: pre; "> </span><span class="n" style="margin: 0px; padding: 0px; border: 0px; color: rgb(51, 51, 51); font-family: Consolas, 'Liberation Mono', Courier, monospace; font-size: 11.818181991577148px; line-height: 14.545454025268555px; white-space: pre; ">token</span><span style="color: rgb(51, 51, 51); font-family: Consolas, 'Liberation Mono', Courier, monospace; font-size: 11.818181991577148px; line-height: 14.545454025268555px; white-space: pre; "> </span><span class="o" style="margin: 0px; padding: 0px; border: 0px; font-weight: bold; color: rgb(51, 51, 51); font-family: Consolas, 'Liberation Mono', Courier, monospace; font-size: 11.818181991577148px; line-height: 14.545454025268555px; white-space: pre; ">=</span><span style="color: rgb(51, 51, 51); font-family: Consolas, 'Liberation Mono', Courier, monospace; font-size: 11.818181991577148px; line-height: 14.545454025268555px; white-space: pre; "> </span><span class="n" style="margin: 0px; padding: 0px; border: 0px; color: rgb(51, 51, 51); font-family: Consolas, 'Liberation Mono', Courier, monospace; font-size: 11.818181991577148px; line-height: 14.545454025268555px; white-space: pre; ">user</span><span class="o" style="margin: 0px; padding: 0px; border: 0px; font-weight: bold; color: rgb(51, 51, 51); font-family: Consolas, 'Liberation Mono', Courier, monospace; font-size: 11.818181991577148px; line-height: 14.545454025268555px; white-space: pre; ">.</span><span class="na" style="margin: 0px; padding: 0px; border: 0px; color: rgb(0, 128, 128); font-family: Consolas, 'Liberation Mono', Courier, monospace; font-size: 11.818181991577148px; line-height: 14.545454025268555px; white-space: pre; ">getSubject</span><span class="o" style="margin: 0px; padding: 0px; border: 0px; font-weight: bold; color: rgb(51, 51, 51); font-family: Consolas, 'Liberation Mono', Courier, monospace; font-size: 11.818181991577148px; line-height: 14.545454025268555px; white-space: pre; ">().</span><span class="na" style="margin: 0px; padding: 0px; border: 0px; color: rgb(0, 128, 128); font-family: Consolas, 'Liberation Mono', Courier, monospace; font-size: 11.818181991577148px; line-height: 14.545454025268555px; white-space: pre; ">getSession</span><span class="o" style="margin: 0px; padding: 0px; border: 0px; font-weight: bold; color: rgb(51, 51, 51); font-family: Consolas, 'Liberation Mono', Courier, monospace; font-size: 11.818181991577148px; line-height: 14.545454025268555px; white-space: pre; ">().</span><span class="na" style="margin: 0px; padding: 0px; border: 0px; color: rgb(0, 128, 128); font-family: Consolas, 'Liberation Mono', Courier, monospace; font-size: 11.818181991577148px; line-height: 14.545454025268555px; white-space: pre; ">getId</span><span class="o" style="margin: 0px; padding: 0px; border: 0px; font-weight: bold; color: rgb(51, 51, 51); font-family: Consolas, 'Liberation Mono', Courier, monospace; font-size: 11.818181991577148px; line-height: 14.545454025268555px; white-space: pre; ">().</span><span class="na" style="margin: 0px; padding: 0px; border: 0px; color: rgb(0, 128, 128); font-family: Consolas, 'Liberation Mono', Courier, monospace; font-size: 11.818181991577148px; line-height: 14.545454025268555px; white-space: pre; ">getId</span><span class="o" style="margin: 0px; padding: 0px; border: 0px; font-weight: bold; color: rgb(51, 51, 51); font-family: Consolas, 'Liberation Mono', Courier, monospace; font-size: 11.818181991577148px; line-height: 14.545454025268555px; white-space: pre; ">().</span><span class="na" style="margin: 0px; padding: 0px; border: 0px; color: rgb(0, 128, 128); font-family: Consolas, 'Liberation Mono', Courier, monospace; font-size: 11.818181991577148px; line-height: 14.545454025268555px; white-space: pre; ">toString</span><span class="o" style="margin: 0px; padding: 0px; border: 0px; font-weight: bold; color: rgb(51, 51, 51); font-family: Consolas, 'Liberation Mono', Courier, monospace; font-size: 11.818181991577148px; line-height: 14.545454025268555px; white-space: pre; ">();</span></div><div><br></div>
<div><div><div>Easy to break like you've did. My initial suggestion, is generate an application ID at first glance and create event or time based tokens.</div></div><div><br></div><div><br></div><div><div>-- </div><div>"The measure of a man is what he does with power" - Plato</div><div>-</div><div>@abstractj</div><div>-</div><div>Volenti Nihil Difficile</div></div></div>
<p style="color: #A0A0A8;">On Thursday, September 27, 2012 at 3:26 AM, Matthias Wessendorf wrote:</p>
<blockquote type="cite" style="border-left-style:solid;border-width:1px;margin-left:0px;padding-left:10px;">
<span><div><div><div>Hi,</div><div><br></div><div>using the Auth-Token to get access to protected resources / endpoints</div><div>(after doing a login) works fine!</div><div><br></div><div>I am wondering how to avoid that one token is used on different</div><div>devices? (e.g. when somebody is 'stealing' the token).</div><div><br></div><div>I did sign-in to the app, using the browser and got the following</div><div>token => db5d16da-a1e5-48d9-a2fd-e39e36e835bc</div><div><br></div><div>Now I was able to issue a get request against the endpoints, by using</div><div>the same token, from different 'devices':</div><div>- curl</div><div>- iOS test case</div><div><br></div><div>NOTE: we don't need a solution now, since I know you guys are busy</div><div>with some demo work - but just want to run that 'issue' by this list</div><div><br></div><div>Greetings,</div><div>Matthias</div><div><br></div><div>-- </div><div>Matthias Wessendorf</div><div><br></div><div>blog: <a href="http://matthiaswessendorf.wordpress.com">http://matthiaswessendorf.wordpress.com</a>/</div><div>sessions: <a href="http://www.slideshare.net/mwessendorf">http://www.slideshare.net/mwessendorf</a></div><div>twitter: <a href="http://twitter.com/mwessendorf">http://twitter.com/mwessendorf</a></div><div>_______________________________________________</div><div>aerogear-dev mailing list</div><div><a href="mailto:aerogear-dev@lists.jboss.org">aerogear-dev@lists.jboss.org</a></div><div><a href="https://lists.jboss.org/mailman/listinfo/aerogear-dev">https://lists.jboss.org/mailman/listinfo/aerogear-dev</a></div></div></div></span>
</blockquote>
<div>
<br>
</div>