1217604 - Improve and document autopush authentication layer

Status: RESOLVED FIXED

(Cloud Services Graveyard :: Server: SimplePush, defect)

Description

[Nick Alexander :nalexander [he/him]]

If we're just going to hash, let's not use the key bytes after converting to UTF-8.  Let's encode them as hex and convert to bytes that way; it's easy to exchange and has worked well for Firefox Accounts.

I'd prefer we use HAWK or add a nonce -- anything less prone to replay attacks.

Comment 1

[JR Conlin [:jrconlin,:jconlin]]

https://github.com/mozilla-services/autopush/issues/201

Comment 2

[JR Conlin [:jrconlin,:jconlin]]

Nick,
we're getting close to landing Hawk on dev. 

https://github.com/mozilla-services/autopush/pull/216

When we do, the old auth token will no longer work. Do you need time to update the client REST access code or is there some flag we can send you so that you know you should use it? 

The current 'register' response still returns a shared secret, so it's not obvious to the code that there's a new method. Mostly because you're the only code that would use it right now. Let me know what's easiest for you to deal with.

Comment 3

[JR Conlin [:jrconlin,:jconlin]]

https://github.com/mozilla-services/autopush/pull/216 merged to dev. scheduled for 1.8 release.

Comment 4

[Nick Alexander :nalexander [he/him]]

jrconlin, benbangert, and I discussed this out of band.  We've sketched a new API, including a simple Bearer auth scheme.  Clearing NI until that gets landed.

Comment 5

[Nick Alexander :nalexander [he/him]]

This is in place.  I'll re-open if we have additional issues.  jrconlin, if you see this -- can you link the github sha?  Thanks!