How to set up a temporally password accessed ressouce?

Question

Context

Developing a platform with contents and some files. Users can create a resource, and set it:

• private: only accessible for him
• protected: accessible via a password that can expire
• public: no security rules to access

Problem

Considering we have that 2 tables:

We want to protect our element table if visibility = 'protected'. So creator should give a password for resource access, and set an expiration date.

Users can set many passwords with a different expiration date. How can we store that password, with security, and thinking about the user can share a password, close password access, and get his password access to share resources when he needs them.

We talk here about a conception of the solution, don't care about languages or orm.

Potential solution

Cron job

Create a table joining passwords with entities, and when the user sets a password, launch a cron job that will set an attribute like active to false when the expiration date is reached.

Problem: making our app stateful, if cloud-based and the pod crash, cron job fell in void...

Store it in base64

To allow users to get back already set passwords, we have to get symmetric encryption algorithm to encrypt and decrypt the password, but that exposes resources if the database is compromised..

Also creating a table joining passwords with entities here.

No more ideas for the moment... How would you do ?

The best solution should be stateless and don't store passwords in clear.

Answer 1

I can think of other two solutions

• A PubSub mechanism, which you can choose to trigger when to execute. For example, when you create a password today and want it to expire tomorrow. you can create a pubsub task that will trigger in a day. The task will remove that password.

• A JWT token, which is a token that encoded the information in there, which includes the expiration date. When you verify that token, you will verify the signature to make sure it is not tampered and also if it is still valid. If you need to store secret inside it, you can use RS256.