Repository files navigation

Wiki |IRC |Gitter Chat

1. Git
2. Node.js v8 or higher
3. MongoDB

1. Clone the repository

$ git clone git@github.com:Laverna/server.git# navigate to the project directorycd server

2. Install dependencies

$ npm install

3. Configure the signal serverCopy .env.example to .env and change configs in the new file.

4. Start the server

$ npm start

To authenticate a client on the server it uses token based authentication by usingJSON Web Tokens andOpenPGP signatures.

The authentication method is based onpublic key authentication method where the possession of the private key serves as authentication.

How does it work?

1. A client requests a session token by sending a GET request to/api/token/username/:username
2. The server generates and sends aJWT token (HS256 algorithm) for the client which will expire after 8 minutes
3. The client signs the session token with their private OpenPGP key and sends a POST request to/api/auth
4. The server:
   1. Checks the authenticity of the signature
   2. Checks the signedJWT session token
   3. If there is no error, it generates an authentication token using JWT. The token will expire after 24 hours
5. The authentication token is used to authenticate the client on the signaling socket server.

The server stores a minimum amount of information which includes your username and public OpenPGP key and fingerprint. Keep in mind if your OpenPGP key includes your email, it can be easily extracted.

Some of your personal information will be available to the public. It is necessary for our REST API.

The following data should be considered public:

1. Your username
2. Your public OpenPGP key
3. Your OpenPGP key fingerprint

The authentication method used in this project was implemented by us and it hasn't been vetted nor audited by security experts. Use it at your own risk.

Published underMPL-2.0 License.