devmentors / dnc-dshop.services.identity Goto Github PK

Why not use IdentityServer or OpenIdDict? Which are most complete and tested frameworks

You use ROPC

I recently read that ROPC may have several security holes, this link addresses some of them:
https://tools.ietf.org/html/rfc6749#section-10.7

brute force, save password in client log, others ...

What is your opinion about this?

New pull request for DShop.Common has been created .
You can see it here.

New pull request for DShop.Common has been created .
You can see it here.

After introducing Jaeger, the call POST {{identityServiceUrl}}/sign-up broke. Or any API call for that matter that is being passed an empty CorrelationContext.
The empty Correlation context is being handled properly in the API gateway, but calls to the IdentityService do no pass the API gateway and in the IdentityService an empty CorrelationContext is not handled properly (and it does not contain a SpanContext that can be send to Jaeger). It throws an exception in the Jaeger middleware.

To fix this, the IdentityService needs to handle empty CorrelationContext's properly. We could borrow the methods from BaseController of the API gateway.
Then, the event, sent from the IdentityService class, also needs that new properly handled CorrelationContext, in order to pass it on when publishing the event.

New pull request for DShop.Common has been created.
You can see it here.