[docs] How to setup Passwordless authentication #7650

jacebenson · 2023-02-16T06:17:08Z

#6204 is an issue that @cannikin and @Olyno were discussing setting up passwordless auth on. I'm not sure if this makes sense to modify how dbauth works (and that's not in the core-repo anymore anyway!) or if adding a how-to to just make it work.

But, I went ahead and made it work and thought I'd add a very rough PR adding these notes.

I created the following repo from teh tutorial and checked in after installing dbauth, and then again after forcing it to be passwordless.

https://github.com/jacebenson/redwood-dbauth-passwordless

I know this is a WIP, but i'd rather put it out there then let it be forgotten on me.

Olyno · 2023-02-17T22:49:41Z

Wow, thank you for sharing the passwordless documentation! It's awesome!

I did notice that the link-based approach may not work for users who check their emails on a phone and use the web platform on a computer. I think a code approach for passwordless could be a great alternative (or a very good addition).

What do you think? Thanks again for your work!

jacebenson · 2023-02-19T00:52:31Z

@Olyno I'm not sure how to set that up.

I think that might be a great extra.

I guess my question is, is this good enough for a cookbook?

Olyno · 2023-02-19T01:25:11Z

It looks good to me. I'll do a more thorough test early next week, and then I'll be able to give more concrete feedback on the documentation.

I'm also waiting to see if anyone from the project wants to give feedback on it, it would be a great addition.

cannikin · 2023-02-20T17:50:11Z

Nice work @jacebenson! Thanks for putting this together. I'm all for making this a cookbook for now, rather than modifying dbAuth. I'm trying to keep dbAuth as simple as possible for as long as possible, and this article shows that you can extend its functionality without having to modify the Redwood codebase.

So you've actually run this code and it works? It's been a while since I worked on dbAuth, but I thought it wouldn't even call the login handler unless the user's email/password matched against the hashedPassword in the database (that check is internal to the dbAuth code). You're hardcoding hashedPassword and salt to just be loginToken and salt which would never pass the security check. Hmmm

Some questions/feedback:

I don't love saying that storing hashed passwords and salts is a security risk. We don't want to imply that just by using dbAuth you've got bad security. If your entire database was compromised then yes, a bad actor would have a headstart trying to crack passwords. But securing your database is kind of job number one when building an app!
You should use something other than Math.random() to create a random number, as it's not random enough for cryptographic stuff. Something like secure random is safer.
You should add a note in the text that devs need to make sure and never add the loginToken field to the SDL, or it will be available for anyone to query via GraphQL.
Having some screenshots of the front end pages that are being build would be awesome.
The article feels like it's missing a conclusion! It just suddenly ends after the last code example! :)

Great work!

jacebenson · 2023-02-20T20:11:43Z

@cannikin I'll make those changes.

I wasn't trying to disparage dbAuth. I love it, I just want my hands as clean as possible. I'll reword the bit about "storing hashed passwords and salts"

Regarding Math.random(), I'm not sure but I'm guessing I can use they Crypto thing to generate the id.

I need to remove the loginToken from the user's SDL (create/edit/read)

I'll add some screenshots throughout.

I'll add a conclusion

I am running this in production for a site I'm messing with but let me patch that SDL before I go linking things.

My Todos;

Reword the bit about "storing hashed passwords and salts" to be better
Use Crytpo to generate a number instead of Math.random() to generate the token
Remove the loginToken from the user's SDL and add a comment or reason why in the cookbook
Add some screenshots of the new login page in it's two states.
Add a conclusion

docs/docs/how-to/dbauth-passwordless.md

…d loginToken from SDLs, Added some screenshots, and added a concusion

jacebenson · 2023-02-20T23:31:16Z

docs/docs/how-to/dbauth-passwordless.md

+    let randomNumber = (() => {
+      let random = CryptoJS.lib.WordArray.random(6)
+      let randomString = random.toString()
+      let sixDigitNumber = randomString.replace(/\D/g, '')
+      if (sixDigitNumber.length < 6) {
+        sixDigitNumber = sixDigitNumber.padStart(6, '0')
+      }
+      if (sixDigitNumber.length > 6) {
+        sixDigitNumber = sixDigitNumber.slice(0, 6)
+      }
+      return sixDigitNumber.toString()
+    })()
+    console.log({ randomNumber }) // email the user this number


I'm not sure if this is a great way to do this, if there's a better way I'm all ears. It works.

hmm, what does WordArray return, letters and numbers? Is it possible it could return all letters, which would end up getting replaced with all zeros? That wouldn't be ideal. haha Is there a function that just returns random numbers? If not, maybe generate a way longer WordArray to start, so you're much more likely to end up with 6 digits?

docs/docs/how-to/dbauth-passwordless.md

Olyno

Thank you for your patience. I tried to follow your cookbook, but without success. Would it be possible to have more information about some parts?

Note that I have only used Redwood a few times, so I think I can help with the use of the passwordless as a beginner.

Olyno · 2023-02-26T23:00:25Z

docs/docs/how-to/dbauth-passwordless.md

+### 2. Setting up the generateToken function
+Next, we need to create a function that will generate a token and an expiration date.
+
+If you followed the tutorial, you might not have a `/api/src/services/users/users.js` file.  If that's the case, you can create it.


How do i get this file? Using the latest Redwood version (4.2.0), and following the tutorial to setup the authentication, i don't have this file generated

jacebenson · 2023-03-10T04:03:40Z

@cannikin @Olyno i'd like to move this along. Anything I can do to move this along?

cannikin · 2023-03-10T23:21:14Z

Hey @jacebenson it would be awesome if @Olyno can verify that everything works as written...sounds like they're having an issue in the previous comment?

Added extra text around how to generate the users service file.

Olyno

I'm really sorry for the delay of my review, here it is right now:

The cookbook is quite well documented and understandable. However, I would have some remarks for some parts of it.

docs/docs/how-to/dbauth-passwordless.md

👍 Co-authored-by: Olyno <[email protected]>

This is just how I prefer it, but really it does not matter one way or the other to me. Co-authored-by: Olyno <[email protected]>

Olyno

Looks good to me!

cannikin · 2023-03-14T21:29:49Z

Looks good except for my couple comments above!

replay-io · 2023-03-14T21:49:29Z

16 replays were recorded for e4bd240.

0 Failed

16 Passed

requireAuth graphql checks

    ```
    locator.waitFor: Target closed
    =========================== logs ===========================
    waiting for locator('.rw-form-error-title').locator('text=You don\'t have permission to do that') to be visible
    ============================================================
    ```
  </ol>
</details>
<li><a href=https://app.replay.io/recording/cff5be3d-078e-4279-80c6-a4ead3f9605a>useAuth hook, auth redirects checks</a></li>
<li><a href=https://app.replay.io/recording/f25556bf-ad60-4701-8487-2a954e3b2768>Check that a specific blog post is prerendered</a></li>
<li><a href=https://app.replay.io/recording/5adc9c91-52bf-4c22-98fc-6162865fc4dd>Check that about is prerendered</a></li>
<li><a href=https://app.replay.io/recording/d8097551-c023-4314-8cca-e7b8e69c0991>Check that homepage is prerendered</a></li>
<li><a href=https://app.replay.io/recording/a63047a5-15f7-4dc3-9c36-64ae312e4611>Check that meta-tags are rendering the correct dynamic data</a></li>
<li><a href=https://app.replay.io/recording/8f803a7a-4597-4515-bba3-23de59827b23>Check that you can navigate from home page to specific blog post</a></li>
<li><a href=https://app.replay.io/recording/8321b200-5344-4192-ac4b-7dafece373bf>Waterfall prerendering (nested cells)</a></li>
<li><a href=https://app.replay.io/recording/fa4aaca6-df56-4c15-af8b-08a9c247e755>RBAC: Admin user should be able to delete contacts</a></li>
<li><a href=https://app.replay.io/recording/e602ba4c-1107-4c83-8996-287787a59d81>RBAC: Should not be able to delete contact as non-admin user</a></li>
<li><a href=https://app.replay.io/recording/66ab2afc-b902-486a-a343-c29c5aaaa0ba>Smoke test with dev server</a></li>
<li><a href=https://app.replay.io/recording/122f4e12-6011-40a0-b8f4-66ef41d8c5a5>Smoke test with rw serve</a></li>
<li><a href=https://app.replay.io/recording/6b1675dd-5a24-4179-9915-5bc438e4dfdf>Loads Cell mocks when Cell is nested in another story</a></li>
<li><a href=https://app.replay.io/recording/b3029107-25dd-477b-b37b-f1343bfb74c0>Loads Cell Stories</a></li>
<li><a href=https://app.replay.io/recording/ab0882f0-27f3-48bf-b559-b14f17c6fcd5>Loads MDX Stories</a></li>
<li><a href=https://app.replay.io/recording/68cbf93e-0850-4f3b-a045-51d62d0a7e42>Mocks current user, and updates UI while dev server is running</a></li>

View test run on Replay ↗︎

Olyno

I just noticed a problem

docs/docs/how-to/dbauth-passwordless.md

I missed that. Good catch. Co-authored-by: Olyno <[email protected]>

thedavidprice · 2023-03-29T01:06:43Z

@jacebenson it looks like you replied to everyone's comments. Are you just waiting for us and/or final review?

@Olyno let me know if your review is approved.

jacebenson · 2023-03-29T01:15:06Z

@thedavidprice I think so. Let me know what else I can do to help move this along.

Removed a double "a".

Olyno

Ah for me it was good, there was just a small change to make but everything seems good on my side now!

thedavidprice · 2023-03-29T20:58:40Z

Merged 🚀

Thanks, everyone!

* passwordless rough * Updated how-to to reword the intro, use Crypto to gen. number, removed loginToken from SDLs, Added some screenshots, and added a concusion * Updated intro again * Update dbauth-passwordless.md Added extra text around how to generate the users service file. * Update docs/docs/how-to/dbauth-passwordless.md 👍 Co-authored-by: Olyno <[email protected]> * Update docs/docs/how-to/dbauth-passwordless.md This is just how I prefer it, but really it does not matter one way or the other to me. Co-authored-by: Olyno <[email protected]> * Updated file based on reviews * Added import needed for service file * Removed unused loading/error variables * replaced send send wth send * Update docs/docs/how-to/dbauth-passwordless.md I missed that. Good catch. Co-authored-by: Olyno <[email protected]> * Update dbauth-passwordless.md Removed a double "a". --------- Co-authored-by: Olyno <[email protected]> Co-authored-by: Rob Cameron <[email protected]> Co-authored-by: David Price <[email protected]>

jacebenson · 2023-04-05T20:58:09Z

I see some formatting issues with the post I made mistakes on I'can't seem to resolve the git differences in this branch locally,

I forgot two `` in the third section, and I can't count so there's two ### 7 sections.

passwordless rough

dc85b3d

jacebenson added 2 commits February 20, 2023 15:18

Merge branch 'redwoodjs:main' into how-to-dbauth-passwordless

55d6bd1

Merge branch 'redwoodjs:main' into how-to-dbauth-passwordless

ce583b1

jacebenson commented Feb 20, 2023

View reviewed changes

docs/docs/how-to/dbauth-passwordless.md Outdated Show resolved Hide resolved

Updated how-to to reword the intro, use Crypto to gen. number, remove…

fe2a396

…d loginToken from SDLs, Added some screenshots, and added a concusion

jacebenson commented Feb 20, 2023

View reviewed changes

docs/docs/how-to/dbauth-passwordless.md Outdated Show resolved Hide resolved

jacebenson commented Feb 20, 2023

View reviewed changes

docs/docs/how-to/dbauth-passwordless.md Outdated Show resolved Hide resolved

jacebenson added 4 commits February 21, 2023 07:29

Updated intro again

e32781a

Merge branch 'main' into how-to-dbauth-passwordless

937473b

Merge branch 'main' into how-to-dbauth-passwordless

3fd0c3a

Merge branch 'redwoodjs:main' into how-to-dbauth-passwordless

e50016d

Olyno reviewed Feb 26, 2023

View reviewed changes

Merge branch 'main' into how-to-dbauth-passwordless

b379036

jacebenson added 2 commits March 10, 2023 21:27

Merge branch 'main' into how-to-dbauth-passwordless

807e83b

Update dbauth-passwordless.md

be68a40

Added extra text around how to generate the users service file.

Olyno suggested changes Mar 13, 2023

View reviewed changes

jacebenson and others added 6 commits March 14, 2023 05:52

Update docs/docs/how-to/dbauth-passwordless.md

5452f87

👍 Co-authored-by: Olyno <[email protected]>

Update docs/docs/how-to/dbauth-passwordless.md

3c007da

This is just how I prefer it, but really it does not matter one way or the other to me. Co-authored-by: Olyno <[email protected]>

Merge branch 'redwoodjs:main' into how-to-dbauth-passwordless

166955c

Updated file based on reviews

0ad63d8

Added import needed for service file

945d2ce

Removed unused loading/error variables

2a057d8

jacebenson requested a review from Olyno March 14, 2023 15:04

Olyno approved these changes Mar 14, 2023

View reviewed changes

Merge branch 'main' into how-to-dbauth-passwordless

5b989b0

cannikin added the release:docs This PR only updates docs label Mar 14, 2023

replaced send send wth send

e4bd240

Merge branch 'main' into how-to-dbauth-passwordless

6949ae2

jacebenson mentioned this pull request Mar 19, 2023

feat: add self hosted passwordless dbauth tskrio/seedling#191

Open

Olyno suggested changes Mar 22, 2023

View reviewed changes

docs/docs/how-to/dbauth-passwordless.md Outdated Show resolved Hide resolved

Update docs/docs/how-to/dbauth-passwordless.md

032a1c7

I missed that. Good catch. Co-authored-by: Olyno <[email protected]>

Update dbauth-passwordless.md

531806f

Removed a double "a".

Olyno approved these changes Mar 29, 2023

View reviewed changes

thedavidprice added 2 commits March 29, 2023 08:40

Merge branch 'main' into how-to-dbauth-passwordless

dbd1772

Merge branch 'main' into how-to-dbauth-passwordless

0f1fc0f

thedavidprice merged commit 461294b into redwoodjs:main Mar 29, 2023

redwoodjs-bot bot added this to the next-release milestone Mar 29, 2023

jtoar modified the milestones: next-release, v4.5.0 Apr 2, 2023

jacebenson mentioned this pull request Sep 5, 2023

[RFC]: Passwordless authentication using Email #6204

Closed

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[docs] How to setup Passwordless authentication #7650

[docs] How to setup Passwordless authentication #7650

jacebenson commented Feb 16, 2023

Olyno commented Feb 17, 2023

jacebenson commented Feb 19, 2023

Olyno commented Feb 19, 2023

cannikin commented Feb 20, 2023

jacebenson commented Feb 20, 2023 •

edited

Loading

jacebenson Feb 20, 2023

cannikin Mar 10, 2023

Olyno left a comment

Olyno Feb 26, 2023

jacebenson commented Mar 10, 2023

cannikin commented Mar 10, 2023

Olyno left a comment

Olyno left a comment

cannikin commented Mar 14, 2023

replay-io bot commented Mar 14, 2023 •

edited

Loading

Olyno left a comment

thedavidprice commented Mar 29, 2023

jacebenson commented Mar 29, 2023

Olyno left a comment

thedavidprice commented Mar 29, 2023

jacebenson commented Apr 5, 2023 •

edited

Loading

[docs] How to setup Passwordless authentication #7650

[docs] How to setup Passwordless authentication #7650

Conversation

jacebenson commented Feb 16, 2023

Olyno commented Feb 17, 2023

jacebenson commented Feb 19, 2023

Olyno commented Feb 19, 2023

cannikin commented Feb 20, 2023

jacebenson commented Feb 20, 2023 • edited Loading

jacebenson Feb 20, 2023

Choose a reason for hiding this comment

cannikin Mar 10, 2023

Choose a reason for hiding this comment

Olyno left a comment

Choose a reason for hiding this comment

Olyno Feb 26, 2023

Choose a reason for hiding this comment

jacebenson commented Mar 10, 2023

cannikin commented Mar 10, 2023

Olyno left a comment

Choose a reason for hiding this comment

Olyno left a comment

Choose a reason for hiding this comment

cannikin commented Mar 14, 2023

replay-io bot commented Mar 14, 2023 • edited Loading

Olyno left a comment

Choose a reason for hiding this comment

thedavidprice commented Mar 29, 2023

jacebenson commented Mar 29, 2023

Olyno left a comment

Choose a reason for hiding this comment

thedavidprice commented Mar 29, 2023

jacebenson commented Apr 5, 2023 • edited Loading

jacebenson commented Feb 20, 2023 •

edited

Loading

replay-io bot commented Mar 14, 2023 •

edited

Loading

jacebenson commented Apr 5, 2023 •

edited

Loading