Skip to content

[FEATURE] Introduce SQLite database for session management #226

Closed
Closed
[FEATURE] Introduce SQLite database for session management#226
Assignees
steveiliop56
Labels
breakingThis issue requires a breaking updateenhancementNew feature or requestpinnedThis issue is pinned
Milestone
v4.0.0

Description

@steveiliop56
steveiliop56
opened on Jul 3, 2025

As mentioned in discord:

Hey @everyone, sorry for pinging everyone but it's for an important matter I would like to inform everyone about. Keeping tinyauth stateless is becoming increasingly hard and it is creating security holes. I believe it's time to introduce a simple statefull tinyauth with a simple sqlite database for session management. This would of course require a docker volume and a breaking update but I think it's worth it as it would skyrocket the security of tinyauth as well as allow for the invalidation of sessions server-side. The cookie will have to store minimal info consisting of a simple UUID instead of the mess that we have right now. Let me know what you think either in ⁠#💻・development or by reacting to this message.

Keeping tinyauth stateless is hard and insecure, that's why we should move to a simple storage backend to store sessions. The idea is to move all the cookie information in a database row and assign a UUID to this row. Then the cookie get's the same UUID. In the authentication flow if the UUID the cookie contains matches with a row of the database, we use the user as usual, if not we assume the session is invalid. For the database we can use Gorm alongside a native SQLite driver to avoid the need for CGO.

Activity

  1. steveiliop56
    self-assigned this
    on Jul 3, 2025
  2. steveiliop56
    added
    enhancementNew feature or request
    breakingThis issue requires a breaking update
    pinnedThis issue is pinned
    on Jul 3, 2025
  3. steveiliop56
    added this to Tinyauthon Jul 3, 2025

  4. steveiliop56 commented on Jul 5, 2025

    @steveiliop56
    steveiliop56
    on Jul 5, 2025
    MemberAuthor

    Reason for this change quoted from Dicsord:

    To begin with stateless relies on the client to store all information about your session and I recently discovered a misconfiguration in the session library I use resulting not encrypting the cookie contents. Although this does not allow someone to create the cookie or modify it, it exposes some personal information like your email address and name. This has been fixed #225 but it still made me worry that small errors like this can expose information. By moving to the database not only you don't store anything important in the cookie except for a UUID but you also have a way smaller cookie size. Additionally by using a database the server can revoke one or all sessions which is currently not possible without changing the secret. Lastly by using a database I can store way more info in comparison to the cookie that could be useful in the future.

  5. steveiliop56
    changed the title [-]Introduce SQLite database for session management[/-] [+][FEATURE] Introduce SQLite database for session management[/+] on Jul 5, 2025
  6. steveiliop56
    added this to the v4.0.0 milestone on Jul 17, 2025
  7. steveiliop56
    moved this to Backlog in Tinyauthon Jul 17, 2025

  8. steveiliop56 commented on Aug 29, 2025

    @steveiliop56
    steveiliop56
    on Aug 29, 2025
    MemberAuthor

    Added in #326

  9. steveiliop56
    closed this as completedon Aug 29, 2025
  10. github-project-automation
    moved this from Backlog to Done in Tinyauthon Aug 29, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

breakingThis issue requires a breaking updateenhancementNew feature or requestpinnedThis issue is pinned

Type

No type

Projects

No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions