[eyglys] resolve duplicated set-cookie

eyglys commented 2 years ago

Proposed changes

Avoid executing clearCookie on AbstractDrivers/Oauth2.loadState method (also on Oauth1) when the cookie does not exist. This bugfix resolves issue #133.

Types of changes

[x] Bugfix (non-breaking change which fixes an issue)
[ ] New feature (non-breaking change which adds functionality)
[ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist

Put an x in the boxes that apply. You can also fill these out after creating the PR. If you're unsure about any of them, don't hesitate to ask. We're here to help! This is simply a reminder of what we are going to look for before merging your code.

[x] I have read the CONTRIBUTING doc
[x] Lint and unit tests pass locally with my changes
[x] I have added tests that prove my fix is effective or that my feature works.
[x] I have added necessary documentation (if appropriate)

Further comments

The use of ally and web sessions (via cookie) sent two set-cookies to the browser. One such set-cookie was a clear (performed by clearCookie). The result of this was the loss of state between the Adonis application and the authentication service.

The bug is described in issue #133 .

The clearCookie should only be run when there is a state cookie (otherwise it will send a set-cookie).

thetutlage commented 2 years ago

I am not sure how does it code fixes this issue https://github.com/adonisjs/ally/issues/133

eyglys commented 2 years ago

The second parameter of encryptedCookie is the default value when the cookie does not exist. This behavior can be used to identify that the cookie does not exist and avoid unnecessary cleaning (set-cookie). I'm not sure if it solves the problem of an expired OAuthSecret, where it will be necessary to overwrite the previous OAuthSecret with the new Secret, in this situation I believe that the clearCookie should not be executed.

stale[bot] commented 2 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

adonisjs / ally