feat(core): guard one-time token on consent request #7160
+206
−50
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
charIeszhao
requested review from
simeng-li,
wangsijie and
gao-sun
as code owners
COMPARE TO
|
| Name | Diff |
|---|---|
| packages/core/src/middleware/koa-consent-guard.test.ts | 📈 +2.79 KB |
| packages/core/src/middleware/koa-consent-guard.ts | 📈 +1.42 KB |
| packages/core/src/tenants/Tenant.ts | 📈 +191 Bytes |
| packages/experience/src/App.tsx | 📈 +198 Bytes |
| packages/experience/src/pages/OneTimeToken/index.tsx | 📈 +55 Bytes |
| packages/experience/src/pages/Register/index.tsx | 📈 +242 Bytes |
| packages/experience/src/pages/SignIn/index.tsx | 📈 +280 Bytes |
| packages/experience/src/pages/SwitchAccount/index.module.scss | 0 Bytes |
| packages/experience/src/pages/SwitchAccount/index.tsx | 📈 +496 Bytes |
| packages/experience/src/utils/search-parameters.ts | 📈 +428 Bytes |
charIeszhao
force-pushed
the
charles-log-10974-guard-one-time-token-on-auto-consent
branch
from
90ba6bf to
7a6309d
Compare
charIeszhao
changed the base branch from
charles-log-10876-experience-build-landing-page-to-handle-token-parameter
to
master
charIeszhao
changed the base branch from
master
to
charles-log-10876-experience-build-landing-page-to-handle-token-parameter
wangsijie
approved these changes
Mar 20, 2025
simeng-li
reviewed
Mar 20, 2025
Comment on lines
24
to
27
| const interactionDetails = await provider.interactionDetails(ctx.req, ctx.res); | ||
| const { | ||
| params: { token, login_hint: loginHint }, | ||
| session, | ||
| } = interactionDetails; |
There was a problem hiding this comment.
nit: there is a koa-interaction-details middleware
| session, | ||
| } = interactionDetails; | ||
|
|
||
| assertThat(session, new errors.SessionNotFound('session not found')); |
There was a problem hiding this comment.
use RequestError('session.not_found') ?
| import assertThat from '../utils/assert-that.js'; | ||
|
|
||
| /** | ||
| * Guard before allowing auto-consent |
There was a problem hiding this comment.
Need some comments here, this middleware should guard one-time-token sign-in only.
| await libraries.oneTimeTokens.verifyOneTimeToken(token, loginHint); | ||
| } catch (error: unknown) { | ||
| if (error instanceof RequestError) { | ||
| if (error.code === 'one_time_token.email_mismatch') { |
There was a problem hiding this comment.
Should reject the sign-in request when login_hint does not match with the value stored in token
simeng-li
requested changes
Mar 20, 2025
charIeszhao
force-pushed
the
charles-log-10876-experience-build-landing-page-to-handle-token-parameter
branch
7 times, most recently
from
c5a27fc to
402e351
Compare
charIeszhao
force-pushed
the
charles-log-10974-guard-one-time-token-on-auto-consent
branch
from
7a6309d to
4ae5524
Compare
Base automatically changed from
charles-log-10876-experience-build-landing-page-to-handle-token-parameter
to
master
March 25, 2025 12:58
charIeszhao
force-pushed
the
charles-log-10974-guard-one-time-token-on-auto-consent
branch
2 times, most recently
from
1ccae5f to
f5bbc6e
Compare
charIeszhao
force-pushed
the
charles-log-10974-guard-one-time-token-on-auto-consent
branch
2 times, most recently
from
e213767 to
7806877
Compare
charIeszhao
force-pushed
the
charles-log-10974-guard-one-time-token-on-auto-consent
branch
from
7806877 to
1f073e0
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
one_time_tokenparam is presented in the URL. The logic is now handled separately in both/sign-inand/registerroutes.Testing
Local dev test
Checklist
.changeset