<div>
Hi Matthias, looks like the PicketBox API only support timeout specified in minutes, so here we go:
</div><div><br></div><div><a href="https://github.com/aerogear/TODO/commit/7f5a0d5fa7756e35ba95d15a0eaca5c7f435ca8c">https://github.com/aerogear/TODO/commit/7f5a0d5fa7756e35ba95d15a0eaca5c7f435ca8c</a></div>
<div><div><br></div><div><br></div><div><div>-- </div><div>"The measure of a man is what he does with power" - Plato</div><div>-</div><div>@abstractj</div><div>-</div><div>Volenti Nihil Difficile</div></div></div>
<p style="color: #A0A0A8;">On Thursday, September 27, 2012 at 7:30 AM, Matthias Wessendorf wrote:</p>
<blockquote type="cite" style="border-left-style:solid;border-width:1px;margin-left:0px;padding-left:10px;">
<span><div><div><div>Hey Bruno!</div><div><br></div><div>On Thu, Sep 27, 2012 at 12:26 PM, Bruno Oliveira <<a href="mailto:bruno@abstractj.org">bruno@abstractj.org</a>> wrote:</div><blockquote type="cite"><div><div>Hi Matthias, this is our biggest concerns to M7, we had some discussions</div><div>about it with PicketBox team to improve it. Currently the token relies on</div><div>PicketBox sessions like this:</div><div><br></div><div> token = user.getSubject().getSession().getId().getId().toString();</div></div></blockquote><div><br></div><div>yep saw the code in the Filter;</div><div><br></div><blockquote type="cite"><div><div>Easy to break like you've did. My initial suggestion, is generate an</div><div>application ID at first glance and create event or time based tokens.</div></div></blockquote><div><br></div><div>Glad we already had some discussion about this (assuming that, base on</div><div>your email).</div><div><br></div><div>I raised another question on IRC (#picketbox), on when the</div><div>PicketBoxSession expires.</div><div>I asked b/c I cloud issue a GET request one hour my last activity,</div><div>using the same 'old' token</div><div><br></div><div>Greetings!</div><div>Matthias</div><div><br></div><div><br></div><blockquote type="cite"><div><div><br></div><div><br></div><div>--</div><div>"The measure of a man is what he does with power" - Plato</div><div>-</div><div>@abstractj</div><div>-</div><div>Volenti Nihil Difficile</div><div><br></div><div>On Thursday, September 27, 2012 at 3:26 AM, Matthias Wessendorf wrote:</div><div><br></div><div>Hi,</div><div><br></div><div>using the Auth-Token to get access to protected resources / endpoints</div><div>(after doing a login) works fine!</div><div><br></div><div>I am wondering how to avoid that one token is used on different</div><div>devices? (e.g. when somebody is 'stealing' the token).</div><div><br></div><div>I did sign-in to the app, using the browser and got the following</div><div>token => db5d16da-a1e5-48d9-a2fd-e39e36e835bc</div><div><br></div><div>Now I was able to issue a get request against the endpoints, by using</div><div>the same token, from different 'devices':</div><div>- curl</div><div>- iOS test case</div><div><br></div><div>NOTE: we don't need a solution now, since I know you guys are busy</div><div>with some demo work - but just want to run that 'issue' by this list</div><div><br></div><div>Greetings,</div><div>Matthias</div><div><br></div><div>--</div><div>Matthias Wessendorf</div><div><br></div><div>blog: <a href="http://matthiaswessendorf.wordpress.com">http://matthiaswessendorf.wordpress.com</a>/</div><div>sessions: <a href="http://www.slideshare.net/mwessendorf">http://www.slideshare.net/mwessendorf</a></div><div>twitter: <a href="http://twitter.com/mwessendorf">http://twitter.com/mwessendorf</a></div><div>_______________________________________________</div><div>aerogear-dev mailing list</div><div><a href="mailto:aerogear-dev@lists.jboss.org">aerogear-dev@lists.jboss.org</a></div><div><a href="https://lists.jboss.org/mailman/listinfo/aerogear-dev">https://lists.jboss.org/mailman/listinfo/aerogear-dev</a></div><div><br></div><div><br></div><div><br></div><div>_______________________________________________</div><div>aerogear-dev mailing list</div><div><a href="mailto:aerogear-dev@lists.jboss.org">aerogear-dev@lists.jboss.org</a></div><div><a href="https://lists.jboss.org/mailman/listinfo/aerogear-dev">https://lists.jboss.org/mailman/listinfo/aerogear-dev</a></div></div></blockquote><div><br></div><div><br></div><div><br></div><div>-- </div><div>Matthias Wessendorf</div><div><br></div><div>blog: <a href="http://matthiaswessendorf.wordpress.com">http://matthiaswessendorf.wordpress.com</a>/</div><div>sessions: <a href="http://www.slideshare.net/mwessendorf">http://www.slideshare.net/mwessendorf</a></div><div>twitter: <a href="http://twitter.com/mwessendorf">http://twitter.com/mwessendorf</a></div><div>_______________________________________________</div><div>aerogear-dev mailing list</div><div><a href="mailto:aerogear-dev@lists.jboss.org">aerogear-dev@lists.jboss.org</a></div><div><a href="https://lists.jboss.org/mailman/listinfo/aerogear-dev">https://lists.jboss.org/mailman/listinfo/aerogear-dev</a></div></div></div></span>
</blockquote>
<div>
<br>
</div>