search

jacobobryant / biff

A Clojure web framework for solo developers.
https://biffweb.com
MIT License
877 stars 41 forks source link

starter/middleware.clj: prevent infinite loop between /app <-> /?error=not-signed-in if (:uid session) but user has been deleted #228

Closed jf closed 2 months ago

jf commented 2 months ago

this would happen in the case of say a dev db cleanup, or a user being removed in prod, etc.

jacobobryant commented 2 months ago

What are the steps to reproduce the infinite loop? I just tried:

  1. Sign in
  2. Stop the app, delete the storage folder, start the app
  3. Go directly to http://localhost:8080/app

However it doesn't redirect me at all--I still end up on the /app page (although the page says Signed in as . since there isn't actually a user document in the database).

Also, both wrap-redirect-signed-in and wrap-signed-in (probably need better names for those...) use the same condition--(some? (:uid session))--so I'm not seeing how those two middlewares could get into a redirect loop unless you modified one of the conditions (e.g. by changing it to (some? (xt/entity db (:uid session)))) but not the other.

jf commented 2 months ago

Also, both wrap-redirect-signed-in and wrap-signed-in (probably need better names for those...) use the same condition--(some? (:uid session))--so I'm not seeing how those two middlewares could get into a redirect loop unless you modified one of the conditions (e.g. by changing it to (some? (xt/entity db (:uid session)))) but not the other.

I see that now. Sorry, my bad! I've been working so long from a finished tutorial, I've assumed that the state of the code at start = state of the code at end. Obviously I'm wrong here and yes, b3d523446b47e1c01cf532c1c00e5b055fcdaf38 is wrong. I'll add a commit to back out the change + put in the actual fix.

jf commented 2 months ago

actually the fix should be with biffweb.com; so I'll close this PR out. Apologies for the mistake!