Repository navigation
fix(react): make the web binding cookie transport only - #193
Merged
Merged
Conversation
AuthProvider's transport no longer accepts mode or tokenStorage, and passing mode 'bearer' throws. Bearer transport stays with @seamless-auth/react-native. Closes #178
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #178. Part of the v0.19 release (fells-code/seamless-auth-api#385).
Why
The browser bindings are meant to be cookie transport only: the server adapter keeps the tokens and the browser holds only
httpOnlycookies. Angular and Vue already enforce it;@seamless-auth/reactstill acceptedtransport: { mode: 'bearer', tokenStorage }, which puts the access and refresh tokens in page script, where an XSS can read them instead of only riding the session.The issue's open questions
@seamless-auth/react? None. Searched main of seamless-templates, seamless-auth-admin-dashboard, roxtarget-api, roxtarget-mobile, roxtarget-web and seamless-auth-docs formode: 'bearer': only this package's README and tests@seamless-auth/react-nativehas its own provider and does not import@seamless-auth/react, so native bearer is unaffected. Nothing else foundWhat
AuthProvider'stransporttype isOmit<TransportOptions, 'apiHost' | 'mode' | 'tokenStorage'>; it always builds cookie transportmode: 'bearer'gets aTypeErrornaming@seamless-auth/react-native, rather than a silent switch to cookiesscripts/check-react-dist.mjsfails the build if the emitted React code configures bearer transport, like Angular's and Vue's checksChecks
npm run lint,npm run format:check,npm run typecheck: passnpm test: 45 suites, 605 tests (Jest) and 41 (Vitest) passnpm run build,npm run check-npm-build(including the new dist assertion): pass