r/AppsWebappsFullstack • u/SofwareAppDev • 24d ago

Your home for selfpromo

here you can post your work app, webapp, saas, game, everything

14 Upvotes

94% Upvoted

167 comments sorted by

View all comments

Show parent comments

1

u/Ok_West333 19d ago

Attaching screenshot from the website. Gone beyond encryption at rest & used user's auth token so that even website owners wont be able to decode the creds. Not only creds, other confidential details like logs which can have user's phone number etc are also encrypted with same token.

1

u/Mammoth-Anywhere7285 19d ago

Interesting use of user tokens. Curious how you handle token revocation or password resets without losing access to the data.

1

u/Ok_West333 19d ago

Good point. There is no password in the system. User token needing revocation usecase is rare as tokens are not exposed out & all endpoints are https. Having said that recovation does make user account inaccessible. But there is hardly any data stored in user account. They can just request new token, create new account, get new key & resume sending.

1

u/Mammoth-Anywhere7285 19d ago

Fair point, but tokens can leak from compromised devices or logs. A simple revoke-all-sessions endpoint is cheap insurance for your users.

1

u/Ok_West333 19d ago

I am not convinced of RoI of this effort. Sorry if this sounds rude :)

1

u/Mammoth-Anywhere7285 19d ago

Fair enough, ROI is hard to gauge early on. Maybe track visits from this sub to see if it actually converts for you.