Pita/etherpad-lite — pull request #283 by jaseg (2011-12-09 10:46:57+00:00)
Title: Enhanced password support

*Two major changes:*
* Passwords are only sent once in plain text from client to server: when they are created. After that, the client uses a token with a two-week lifespan to authenticate against the server
* One can now set a password from within the pad editor. Currently anyone with access to the pad can do this.

*Problems:*
* I did have to fiddle with some code I did not fully understand, in particular around this whole "group" thing...
* This change breaks any existing passwords, though - if needed - a migration function should not be too complex (and would not need any user interaction).

*To-do:*
* Move the token timeout to some config file
* Make a nice toolbar icon for the "set password" button (currently it shares the icon of the "embed" button)
* Remove the need to authenticate right after a password has been set

The timed token is generated client-side, which is good, since it eliminates any need for passwords or their hashes flying around in the internet during authentication. However, one minor issue with this is that the client now comes with a javascript sha256-implementation.