Closed jojoca-appcues closed 3 months ago
If two users are using the same priv_key
, which isn't a good practice anyway, why do you need to cache it twice? The key is the same, so why double cache it?
Ah. I see. The token is cached with the user details, so the cache key needs to include that.
Not a great security practice to use the same key for multiple users, but I understand how it can be needed sometimes.
Describe the bug When multiple users or accounts share the same
priv_key
, TokenCache will return the data associated with the first cached information.To Reproduce
fetch_token
with an account, user and priv_keyfetch_token
with the same priv_key used above, but different user or accountExpected behavior Each account/user/priv_key must have an independent key on the cache
PR with the suggested fix https://github.com/HGInsights/avalanche/pull/48