Offline logout

Interesting logout use case.

Transcript

1. Solving offline logout By Igor Wojda @igorwojda
2. Not so long long time ago...
3. Username & password Login request Other request Other request
4. Why this is not very secure?
5. Username & password
6. Solution?
7. Token 209eb9bb-2f6c-40d6-a9b9-912257492b61
8. Token
9. Token Renewal Timeout
10. Token per client
11. Token invalidate
12. Online Logout
13. Online logout Logout Request Additional operations
14. Offline Logout
15. Offline logout Logout Request X No network
16. Option 1 – delete device token instantly Logout Request X No network
17. Option 2 – delete device token device when online Logout Request X No network
18. Logout user latter using the token Remove token instantly Goals
19. Solution?
20. Token Logout token Authentication token
21. Token Press logout Is online? Delete authentication token Logout (hit logout endpoint sending logout token) Job scheduler runs logout job Invalidate both tokens Unregister device from receiving notifications NO Schedule logout Job YES Is online? YES
22. • https://android.jlelse.eu/solving -offline-logout-problem- f3b50da49e7eTable salt • https://www.owasp.org/index.p hp/Session_Management_Cheat _Sheet#Session_Expiration • https://security.stackexchange. com/questions/29988/what-is- certificate-pinning Materials Worth reading
23. Thanks! ANY QUESTIONS? You can find me at @igorwojda igor.wojda@gmail.com