19 lines
1.5 KiB
Markdown
19 lines
1.5 KiB
Markdown
# What is stored and how
|
|
|
|
| Data | Form |
|
|
|---|---|
|
|
| USOS access token and its secret | AES-256-GCM with `TOKEN_ENC_KEY`, bound to the user id and the field |
|
|
| Calendar address token | 32 random bytes; a SHA-256 hash to look the feed up, and an encrypted copy to show the address on the page |
|
|
| Browser session | 32 random bytes in an `HttpOnly`, `SameSite=Lax` cookie for seven days; only its SHA-256 hash is stored |
|
|
| Timetable | Plain: course, class type, group, room, building, address, lecturers, times |
|
|
| Profile | USOS user id and name |
|
|
|
|
Only the `studies` and `offline_access` scopes are requested. No e-mail, no personal data, no grades.
|
|
|
|
- Revoking or reissuing the calendar address replaces the stored hash in one statement; the next request to the old address is answered with 404.
|
|
- Sign-out revokes the token in USOS, then deletes the tokens, the calendar address and the sessions. With the checkbox, the user and the timetable are deleted as well.
|
|
- When USOS rejects a token, it is deleted; the timetable stays until the user signs out with deletion.
|
|
- Nothing is logged per request. Error logs carry the user id and the USOS error message, never a token, a signature or a calendar address. The reverse proxy in front must not log request paths of `/f/`.
|
|
- Forms are protected against cross-site requests by the `Sec-Fetch-Site` and `Origin` check of Go's `http.CrossOriginProtection`. A sign-in is bound to the browser that started it by a one-time cookie.
|
|
- The page sends `Content-Security-Policy: default-src 'none'` with inline styles only and has no scripts.
|