Discrepancy in documentation of password rotation.

[chrisroode]

Discrepancy in documentation of password rotation.

[chrisroode]

After a little thinking today. I'd be willing to contribute a solution to this. I was able to get ironSession working, and I think the only thing that needs an update is the documentation. What are your thoughts?

(I'm writing this because your contributing guide mentions discussing an issue before forking and working.

[vvo]

@chrisroode go for it yep 👍 if you made it work and figured out let's update the doc

[vvo]

I believe the id should always go up, you cannot reuse the ids

[chrisroode]

Yeah, that's what I noticed. I'm making the following assumptions, and would love to run them by you just in case I'm inaccurate:

1. The passwords is an object with number keys, and the value is a password string.
2. The program doesn't have any problem with missing lower numbers in the password object.
3. When saving a cookie, iron-session uses the highest number key.

So my workaround is to record two passwords (new and old) and also a count for what password iteration the program is on. I construct an object in the following way:

let password = {};
password[count] = old;
password[count+1] = new;

and the incrementing script performs the following logic.

old = new;
new = generatePasswordFunction();
count += 1;

That seems to be working, and it has a theoretical limit of Number.MAX_SAFE_INTEGER, which won't be hit any time in the next universe with weekly password updates. Even if it did, the consequence for resetting back to 1 is forcing another login by all users.

[chrisroode]

Okay, I made a pull request. I did not run tests since i only changed the .md file. Let me know if you need anything else!