What stops you from creating two separate controllers, one for

Question

Java

Dmytro Buryak

What stops you from creating two separate controllers, one for

regular password and another for otp?

0

22.02.2024

2 ответов

25 просмотров

Dmytro Buryak Автор вопроса

nobi Suke
actually i can able to create two different route ...

That's the thing, you don't need any spring security for OTP endpoint at all. It's not classic authN/authZ task which spring-security is used for. Key part in OneTimePassword is *one time*. Spring-security with its mechanisms is about securing your endpoints and making sure that only clients who are allowed are accessing secured resources. While OTP is about *one time* login action (or some other kind of one-time action, like password reset, onboarding, etc.) only. It's not about securing anything. OTP is about having a special public endpoint where users can perform one-time action providing server-generated (usually expirable) secret (which gets deleted after it's used). It's not a regular credentials, you shouldn't secure your main endpoints with OTP. OTP should be used only for this one-time action. In other words, users shouldn't be allowed to make calls to your main secured endpoints with OTP creds. They only should be allowed to log in (or other one-time flow) with OTP on special endpoint. Also, OTP for login will not work with username+password auth as you have it right now. Well, it may work fine only for some other one-time flows, like password reset or some registration flow. But it won't work for login. Because your main auth mechanism requires *USER* to provide password. I.e., server doesn't know the password. And OTP won't be able to subtitute it, because it's *ONE TIME*, it should get deleted after its first use. OTP for login can work only if you use token based auth. Where tokens are generated by *SERVER*. In this mechanism, instead of providing "username+password" with requests (like you have right now), clients provide tokens. Tokens are generated by server, and server manages their lifecycle and validity. OTP are usually called "refresh token", and regular tokens for accessing secured resources are called "access tokens".

0

10 месяцев назад

nobi Suke · Accepted Answer

nobi Suke

actually i can able to create two different route one for regular password and one for email otp but in otp route if i will type my regular password then also it get authenticated

0

10 месяцев назад

Похожие чаты

What stops you from creating two separate controllers, one for

2 ответов

Похожие вопросы