Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[Bug][Security] Auth.Store.ts: Zustand persist middleware stores auth state in localStorage, making token and user data accessible to any JavaScript on the page

Aperta
  • Qualcosa non va?
#128 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

@anshul23102 ci sta già lavorando.

Dal 8/6/2026.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Tranquilla
Stack tecnologico
tauri, typescript
Ambito
authentication, desktop, security

Direzione di ricerca

Start with src/features/Auth/v1/Store/Auth.Store.ts and inspect how Zustand persist writes the auth token and user data. Review the related Tauri CSP concern and determine whether the intended session flow is memory-only or requires an encrypted store. Done means auth credentials are no longer serialized to plaintext localStorage and the chosen secure re-establishment or persistence behavior is covered.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Bug Summary

src/features/Auth/v1/Store/Auth.Store.ts uses Zustand's persist middleware with the default storage backend, which is localStorage:

const useAuthStore = create<AuthState>()(
  persist(
    (set) => ({
      token: null,
      user: null,
      setAuthData: (user: User) => set({ user }),
      clearAuthData: () => set({ user: null, token: null }),
    }),
    {
      name: "auth-storage",   // key written to localStorage
    },
  ),
);

localStorage is accessible to any JavaScript running in the same origin. In a Tauri application where CSP is disabled (see related issue), this is especially dangerous because injected scripts can read localStorage.getItem('auth-storage') and extract the full auth token and user object without any restriction.

Even with CSP enabled, localStorage is not suitable for storing authentication tokens because:

  1. It is synchronously readable by all JavaScript on the page, including third-party libraries.
  2. It persists indefinitely until explicitly cleared, even after the user closes the application.
  3. It is not HttpOnly -- the fundamental property that makes cookies resistant to XSS-based token theft.

For a Tauri desktop app, sensitive credentials should be stored using Tauri's secure storage plugin (tauri-plugin-stronghold or the OS keychain via tauri-plugin-store with encryption) rather than plaintext localStorage.

Expected Behavior

Auth tokens should not be persisted in localStorage. Session state should be kept in memory only (without the persist middleware) and re-established on app launch via a secure token refresh flow. If persistence is required, use an encrypted store.

Actual Behavior

Auth state (including token and user data) is serialised to plaintext localStorage on every state update.

Affected File

src/features/Auth/v1/Store/Auth.Store.ts

@NexGenStudioDev I would like to work on this issue. Could you please assign/ it to me? Contributing under NSoC '26.

Lingua principale
TypeScript
Stelle
7
Fork
17
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di NexGenStudioDev/CommDesk

Tutte le issue di NexGenStudioDev/CommDesk

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.