search

brave / ads-ui

Self-service ads UI
Mozilla Public License 2.0
23 stars 11 forks source link

Production Release 2024-08-06 #1303

Closed IanKrieger closed 1 month ago

IanKrieger commented 1 month ago

Features

Fixes

github-actions[bot] commented 1 month ago

[puLL-Merge] - brave/ads-ui@1303

Description

This PR makes significant changes to the authentication process in the Brave Ads UI, particularly focusing on the magic link authentication flow. The changes aim to improve security and user experience during the login process.

Changes ### Changes 1. src/auth/hooks/queries/useAuthorize.ts - Refactored the `useAuthorize` hook to use `useCallback` instead of `useEffect`. - Removed the `data` state and its setter. - Added a `verify` function that can be called with `code` and `id`. 2. src/auth/lib/index.ts - Changed the `getLink` and `authorize` functions to use POST requests instead of GET. - Updated the request bodies to send data as JSON instead of query parameters. 3. src/auth/views/AuthVerify.tsx - Completely redesigned the verification page UI. - Added a "Continue" button for users to explicitly initiate the login process. - Improved error handling and messaging. 4. src/auth/views/MagicLink.tsx - Updated the text for the "Don't see the email?" section. 5. src/auth/views/components/AuthContainer.tsx - Slightly increased the maximum width of the auth container. 6. Localization files (en.po, es.po, pt.po, test.po) - Updated and added new localization strings to reflect the UI changes.

Security Hotspots

  1. The change from GET to POST requests in src/auth/lib/index.ts for getLink and authorize functions improves security by not exposing sensitive data in URL parameters.

  2. The explicit "Continue" button in the verification process (src/auth/views/AuthVerify.tsx) adds an additional step of user confirmation before completing the login, which can help prevent automated login attempts.

Possible Issues

  1. The removal of automatic redirection after successful login in AuthVerify.tsx might confuse users who are accustomed to the old flow. Clear instructions and UI feedback will be crucial to guide users through the new process.

  2. The changes to the authorization process might require updates to any external systems or documentation that reference the old flow.