Offline logout

Transcript

1. Solving offline logout By Igor Wojda @igorwojda

2. Not so long long time ago...

3. Username & password Login request Other request Other request

4. Why this is not very secure?

5. Username & password

6. Solution?

7. Token 209eb9bb-2f6c-40d6-a9b9-912257492b61

8. Token

9. Token Renewal Timeout

10. Token per client

11. Token invalidate

12. Online Logout

13. Online logout Logout Request Additional operations

14. Offline Logout

15. Offline logout Logout Request X No network

16. Option 1 – delete device token instantly Logout Request X

    No network

17. Option 2 – delete device token device when online Logout

    Request X No network

18. Logout user latter using the token Remove token instantly Goals

19. Solution?

20. Token Logout token Authentication token

21. Token Press logout Is online? Delete authentication token Logout (hit

    logout endpoint sending logout token) Job scheduler runs logout job Invalidate both tokens Unregister device from receiving notifications NO Schedule logout Job YES Is online? YES

22. • https://android.jlelse.eu/solving -offline-logout-problem- f3b50da49e7eTable salt • https://www.owasp.org/index.p hp/Session_Management_Cheat _Sheet#Session_Expiration •

    https://security.stackexchange. com/questions/29988/what-is- certificate-pinning Materials Worth reading

23. Thanks! ANY QUESTIONS? You can find me at @igorwojda igor.wojda@gmail.com