I can work on adding “sessions” functionality for the next release. But the user will need to log in at least once, per device. The session id would still need to stored on the device, but it would have a time limit and be encrypted/decrypted server-side (using some items from the client device as well as a server-side only key) so it would be nearly impossible to gain the users id.
I’m not sure how long it will take to implement, but I’ll start working on it next week. You could attempt to do it manually as well using what I outlined. You’ll need to reissue a new session id when the old one expires, though that might not be totally needed. If you encrypt/decrypt the session id server-side with a custom key, then you’re pretty safe.
Coronium Core has LuaCrypto installed, which you can use to encrypt/decrypt an id with a special key of your choosing on the server-side, if you go the manual route.
But, I think it would be a good feature as it is, so I’ll work on adding it in regardless.
If you just wanted to implement something simple here is one example:
Server-side API
local api = core.api() function api.encryptSession( input ) local crypto = require("crypto") local sessionSecretKey = "1282a8d89b4d2ae466667b1e6e5f846183feb2c6405408a843a04cd7e1b706be" local sessionId = crypto.encrypt("aes256", input.user\_id, sessionSecretKey) sessionId = core.encode.b64(sessionId) return { session\_id = sessionId } end function api.decryptSession( input ) local crypto = require("crypto") local sessionId = core.decode.b64(input.session\_id) local sessionSecretKey = "1282a8d89b4d2ae466667b1e6e5f846183feb2c6405408a843a04cd7e1b706be" local userId = crypto.decrypt("aes256", sessionId, sessionSecretKey) return { user\_id = userId } end return api
Your client-side calls would look something like:
--# Encrypt local function onEncryptSession(e) if (e.result.session\_id) then local sessionId = e.result.session\_id -- Store the sessionId to a file (not shown) end end core.api.encryptSession({user\_id="\<user-id\>"}, onEncryptSession) --# Decrypt local function onDecryptSession(e) if (e.result.user\_id) then print(e.result.user\_id) -- the users id end end -- Get the sessionId from stored file (not shown) core.api.decryptSession({session\_id=sessionId}, onDecryptSession)
core.encode/decode is an internal api that isn’t documented at this time.
I can work on adding “sessions” functionality for the next release. But the user will need to log in at least once, per device. The session id would still need to stored on the device, but it would have a time limit and be encrypted/decrypted server-side (using some items from the client device as well as a server-side only key) so it would be nearly impossible to gain the users id.
I’m not sure how long it will take to implement, but I’ll start working on it next week. You could attempt to do it manually as well using what I outlined. You’ll need to reissue a new session id when the old one expires, though that might not be totally needed. If you encrypt/decrypt the session id server-side with a custom key, then you’re pretty safe.
Coronium Core has LuaCrypto installed, which you can use to encrypt/decrypt an id with a special key of your choosing on the server-side, if you go the manual route.
But, I think it would be a good feature as it is, so I’ll work on adding it in regardless.
