Open dinvlad opened 6 years ago
Hi @dinvlad, our bug fix has been pushed! Please use version v1.1.1, you can download directly from github or use npm to install the latest version. Thanks!!
@yuntuowang's comment implies this has been fixed, but the issue is still open??
Alas I cannot verify this as we moved to Firebase. If others can confirm, I'll close it.
Hi Team,
It appears that
clearCachedTokensScopes()
does not work as intended, because it referencesthis.username
and that parameter isundefined
. When instantiatingCognitoAuth
,this.username
is set tothis.getLastUser()
(and this is the only place it is set automatically*). However, by that time the last user is not yet set becausecacheTokensScopes()
is called only afterparseCognitoWebResponse()
. As a result, the user session is not cleared at all (except for, ironically, the value ofLastAuthUser
), and other people logging in on the same device can potentially steal the user tokens. Also, this polluteslocalStorage
over time as the old tokens are not removed in a multi-user environment.I suggest we should call
this.getCurrentUser()
instead ofthis.username
inclearCachedTokensScopes()
to ensure that the current user is referenced correctly. Alternatively (even better), we should updatethis.username
aftercacheTokensScopes()
.*Currently, to work around that without patching CognitoAuth, we must explicitly call
auth.setUser(auth.getCurrentUser())
in ouronSuccess()
callback, which is a bit silly.Thank you