crossbario / crossbar

Crossbar.io - WAMP application router
https://crossbar.io/
Other
2.05k stars 274 forks source link

`wamp.session.kill_by_authrole` does not follow spec #2082

Open ecorm opened 1 year ago

ecorm commented 1 year ago

wamp.session.kill_by_authrole closes the session of the caller issuing that meta procedure, but the WAMP spec forbids this:

If the caller's own session has the specified authrole, the caller's session is excluded from the closed sessions.

See trace from the client issuing the meta procedure call:

["TX","HELLO",[1,"cppwamp.test",{"agent":"cppwamp-0.11.1","roles":"snipped"}]]
["RX","WELCOME",[2,5111111940399149,{"authextra":"redacted","authid":"CNTF-SPVQ-X3XL-PWMU-CPRU-3T6N","authmethod":"anonymous","authprovider":"static","authrole":"anonymous","realm":"cppwamp.test","roles":"snipped","x_cb_node":"redacted","x_cb_peer":"redacted","x_cb_pid":11949,"x_cb_worker":"worker001"}]]
["TX","CALL",[48,1,{},"wamp.session.kill_by_authrole",["anonymous"],{}]]
["RX","GOODBYE",[6,{},"wamp.close.normal"]]
["TX","GOODBYE",[6,{},"wamp.close.goodbye_and_out"]]

In case it matters, this occurred with Crossbar's built-in anonymous authenticator. The session issuing the call had the anonymous authrole.


Furthermore, Crossbar's wamp.session.kill_by_authrole returns an array, whereas the spec mandates that it returns a count integer.