codepod-io / codepod

Codepod IDE: Scalable Interactive Coding
https://codepod.io
MIT License
75 stars 15 forks source link

Guest auth token is incorrectly sent with user login HTTP request #404

Closed lihebi closed 1 year ago

lihebi commented 1 year ago

When a user is not logged in, the "guest" token will be sent with every HTTP request. Consequently, when the guest token expires (in 30 days), the user cannot log in again without manually deleting the guestToken from the browser cache.

https://github.com/codepod-io/codepod/blob/705940f67d5d6da5dbbea0fa636cc9d3c401c081/ui/src/lib/auth.tsx#L36-L40

Correct behavior:

  1. Short-term fix: do not send guest tokens for user signup/logins
  2. Long-term: the guest system has many flaws, e.g., repos not merged after registration. We need a better way to handle guests, preferably local-only with IndexedDB & Yjs.