tangled.org / core
Monorepo for Tangled tangled.org
fork atom

appview: don't trust oauth.ClientSessionData #1188

open opened by boltless.me targeting master from sl/uvpzuszrulvq

oauth.ClientSessionData.HostURL is not validated after first session creation. If user switches the PDS while logged in, .HostURL will still point to old PDS, showing account management options for tngl.sh users. This can confuse users to accidentally put account in odd state (activated in both PDSes)

Instead, always resolve Handles and PDS hosts on-demand. Technically HostURL is used on creating authorized atpclient, but that's ok because request to old PDS will reject the request.

Ideally we should revoke user sessions on #account event, indigo currently doesn't support DID based revoking.

Signed-off-by: Seongmin Lee git@boltless.me

STACK 11
#800 draft: appview: service layer
1/3
0
#18
#1027 appview: remove oauth.User type
3/3
0
#7
#1021 appview/pulls: remove dependencies to oauth.MultiAccountUser
1/3
0
#7
#1026 appview/pages: don't access MultiAccountUser.Active from template
2/3
0
#7
#1025 appview/oauth: remove .Handle from oauth.AccountInfo
2/3
0
#7
#1024 appview/oauth: remove AuthReturnInfo
1/3
0
#7
#1020 appview/{oauth,pages,state}: remove unused AddAccount session data
1/3
0
#7
#1023 appview/{pages,state}: simplify LoginPage params
2/3
0
#7
#1022 appview/{oauth,pages}: cleanup unused codes
1/3
0
#7
#1188 appview: don't trust oauth.ClientSessionData
2/3
0
#2
#1150 appview: use explicit TANGLED_PDS_HANDLE_SUFFIX for tngl.sh user check
1/3
1
#3
ABANDONED PULLS 2
#1149 appview: wip
0
#0
#1028 appview/{oauth,pages}: remove Pds field from oauth.User
0
#4
Labels

None yet.

assignee

None yet.

Participants 1
AT URI
at://did:plc:xasnlahkri4ewmbuzly2rlc5/sh.tangled.repo.pull/3mhivzoc7en22
Interdiff #1 → #2
appview/ingester.go

This file has not been changed.

appview/oauth/accounts.go

This file has not been changed.

appview/oauth/accounts_test.go

This file has not been changed.

appview/oauth/oauth.go

This file has not been changed.

appview/pages/funcmap.go

This file has not been changed.

appview/pages/templates/user/settings/profile.html

This file has not been changed.

appview/settings/danger.go

This file has not been changed.

appview/settings/settings.go

This file has not been changed.

appview/state/router.go

This file has not been changed.

History

3 rounds 0 comments
sign up or login to add to the discussion
boltless.me submitted #2
diff
1 commit
expand
727ae641
appview: don't trust oauth.ClientSessionData
1/3 failed, 2/3 success
expand
build.yml
fmt.yml
test.yml
no conflicts, ready to merge
expand 0 comments
boltless.me submitted #1
diff interdiff
1 commit
expand
727ae641
appview: don't trust oauth.ClientSessionData
1/3 failed, 2/3 success
expand
build.yml
fmt.yml
test.yml
expand 0 comments
boltless.me submitted #0
diff
1 commit
expand
ea0f1cd5
appview: don't trust oauth.ClientSessionData
expand 0 comments