Application not fully stateless

[ivard]

The application stores the tokens it sends by SMS in memory. This means that the application cannot be replicated at the moment for high availability. In a Kubernetes setup, this application can restart at any moment. This means that the application state gets lost then and SMS message sent out just before the restart are not valid anymore.

irma_sms_issuer/src/main/java/foundation/privacybydesign/sms/TokenManager.java

Line 21 in 5fcf3de

private final Map<String, TokenRequest> tokenMap;

This application has some rate limiting built-in to prevent that attackers can send a very large amount of SMS messages to a single user. This rate limiting is currently also done in memory. This should also be resolved.

irma_sms_issuer/src/main/java/foundation/privacybydesign/sms/ratelimit/MemoryRateLimit.java

Line 21 in 5fcf3de

public class MemoryRateLimit extends RateLimit {