Dashboard: a session check in flight at logout can briefly bring the previous user back

Aperta
  • Qualcosa non va?
#1,579 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
45/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
javascript
Ambito
authentication, frontend

Direzione di ricerca

The race involves the dashboard's user loader for /auth/me, the logout handler, the storage-event listener that reloads the user, and refresh() after SSO sign-in; start by finding where each of these sets the user and the token. Reproduce with the jsdom probe described in the issue: hold /auth/me open, log out, then let it answer 200. Done means a stale answer from before logout is dropped, and a test covers the storage sign-in resetting the post-logout ?next= landing page.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug

After #1577, logging out clears the dashboard's session at once instead of waiting for the server. A session check that was already in flight at that moment can still answer afterwards and put the previous user back in the dashboard's memory, with no token.

How it is reached: only while a /auth/me check is outstanding when the user clicks Log out. That happens when another tab changed the stored token (the storage listener reloads the user) or right after an SSO sign-in (refresh()).

What the user sees: the previous user's name for a moment. Nothing loads, because the next API call has no token, answers 401, and the dashboard goes to the sign-in page. The same can happen on main, but less often, because main cleared the session only after the logout request answered.

Measured in jsdom by holding /auth/me open, logging out, then letting it answer 200: the user comes back as signed in with no token, on main and on #1577.

Suggested fix: a generation counter that logout and sign-in bump, with the user loader dropping any answer from an older generation. The probe above becomes its test.

Also a test gap from the same review: nothing pins that a sign-in arriving through another tab (the storage event) resets the post-logout landing page. A test that logs out, fires a storage sign-in, then drops the token and expects ?next= again would cover it.

Lingua principale
Python
Stelle
0
Fork
4
Merge medio
5h 19m
PR unite (30g)
503

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di Controlvar/controlvar

Tutte le issue di Controlvar/controlvar

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.