okfn/annotator-store — pull request #38 by nickstenning (2012-03-16 15:00:29+00:00)
Title: New authtoken format for extensibility and security

The current authtoken format has some serious problems. In particular, the inclusion of additional fields in the authtoken (to denote, for example, user groups or roles) is currently unspecified. As if that weren't enough, the method used to compute the authtoken is cryptographically naïve -- see issue #33.

The new method uses the `itsdangerous` library to "sign" an arbitrary JSON object with a timestamp and a URL-encoded HMAC-SHA1 signature. This solves both of the problems identified above.

`itsdangerous`'s method is chosen over [JSON Web Tokens](http://openid.net/specs/draft-jones-json-web-token-07.html) because it allows our front-end to "unsafely" extract information from the authtokens with minimal extra code.

That said, JWT seems to be well on the way to standardisation, so I may well bite the bullet and switch, adding a few dozen lines (for `base64_urldecode`) to the Annotator auth plugin.

I'd appreciate any comments or criticisms of this implementation.