mirror of
https://github.com/pocket-id/pocket-id.git
synced 2025-12-11 07:32:57 +03:00
🚀 Feature: Add ability to require re-authentication for specific clients #219
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @RealOrangeOne on GitHub.
Feature description
When authenticating with a service, a user should need to explicitly click "sign in", rather than automatically being authenticated and redirected. This can be sort of implemented by setting a very small
$SESSION_DURATION, however that has other UX downsides, notably when managing a Pocket-ID account itself.Explicit consent gives the user more control over the services they log in with, but can also increase security for their accounts.
Pitch
With an active session, users logging in to a service are automatically authenticated and redirected back to the service. This could cause unintended logins, potentially used as part of tricking a user into authentication a session for someone else.
Authentik has the ability to set a given OIDC client as requiring explicit or implicit consent, which would work nicely here. I think for compatibility the "explicit" variant should be opt-in (implicit by default).
Additionally, given the relative ease of authenticating with a passkey, perhaps the "explicit" variant should not only require user interaction, but also re-authentication with the passkey (perhaps 3rd state of "explicit-with-auth").
@barryp commented on GitHub:
I wonder if Pocket-ID's own web UI should have the option to require re-authentication - so that if a user logs into some other website (setup as an OIDC Client) using Pocket-ID, their browser can't then be used to get into the Pocket-ID management interface without some consent or interaction.
@stonith404 commented on GitHub:
Yes, I think we can combine this with re-authentication.
I suggest adding a checkbox to the OIDC client called "Requires re-authentication." If enabled, users must authenticate with their passkey before being redirected, regardless of whether they are currently signed in to Pocket ID.