Secure token request helper swallows API errors and hides auth/cookie failures
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 65/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- typescript
- Domain
- authentication
Research direction
Start at packages/auth/src/utils/tokenRequestHandler.ts:25-26 and inspect the catch block and its callers. Reproduce a failed /auth-token request in secure auth mode, then verify that request failures reject instead of resolving to undefined and that callers can distinguish failure from a missing token.
Written by the indexing model from the issue text.
Description
Summary
tokenRequestHandler logs errors but does not rethrow them, causing failed secure token requests to silently resolve as undefined.
Affected Code
packages/auth/src/utils/tokenRequestHandler.ts:25packages/auth/src/utils/tokenRequestHandler.ts:26
Problem
In the catch block, errors are only logged:
- no rethrow
- no explicit failure result
This makes callers treat real request failures as missing token/null-like outcomes.
Impact
- Silent auth/cookie failures
- Hard-to-debug secure login behavior
- Error handling paths are bypassed because promise rejection never occurs
Reproduction
- Use secure auth mode.
- Cause
/auth-tokenrequest to fail (network failure / non-2xx). - Observe
tokenRequestHandlerreturnsundefinedinstead of rejecting. - Caller falls back as if no token was present.
Expected
Request failure should reject so callers can handle true error conditions.
Actual
Failure is swallowed and converted into implicit undefined.
Proposed Fix
Rethrow after logging in tokenRequestHandler (or return a typed error result), so callers can reliably distinguish failure from missing token cases.
- Dominant language
- JavaScript
- Stars
- 165
- Forks
- 381
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 1
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from RocketChat/EmbeddedChat
-
enhancement
Difficulty 1/5 Under an hour Newbie friendliness 84/100
RocketChat/EmbeddedChat#1360 · 1 comment ·
-
Permissions change-detection in useFetchChatData is dead — applyPermissions re-runs on every call Open
Difficulty 1/5 Under an hour Newbie friendliness 85/100
RocketChat/EmbeddedChat#1317 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
RocketChat/EmbeddedChat#1315 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
RocketChat/EmbeddedChat#1313 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
RocketChat/EmbeddedChat#1294 ·
All issues in RocketChat/EmbeddedChat
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
HarperFast/skills#96 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
sugarlabs/musicblocks#8847 ·
-
client-controller-update ta-bot-triage team-money-movement
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
MetaMask/metamask-mobile#36594 ·