search

julianlam / nodebb-plugin-session-sharing

Allows login sessions from your app to persist in NodeBB
MIT License
88 stars 65 forks source link

(rookie mistake) Payload valid, but local account not found. #44

Closed mildful closed 6 years ago

mildful commented 6 years ago

Hi !

First of all, thanks for this really cool plugin.

I have a little issue when connecting the user. I think it's just a rookie mistake u_u".

I'm creating a JWT token and storing it in a cookie. Here is an example of one of my tokens:

eyJhbGciOiJIUzI1NiIsInR5cGUiOiJKV1QifQ.eyJpZCI6MTQsInVzZXJuYW1lIjoidGVzdDEiLCJuYmYiOjE1MTcyNTc2NTcsImlhdCI6MTUxNzI1NzY1NywiZXhwIjoxNTE3MzQ0MDU3fQ.Nn1vGJB3G3PbNrraUAT5jBnHLMXJUT0cxCg6FWrVSYw

According to jwt.io it is fine. NodeBB is able to decode it and read the payload but it cannot find a valid account. Here is the exact message :

[session-sharing] Payload valid, but local account not found. Assuming guest.

Of course a user with uid 14 and username "test1" exists. Here is a screenshot just to be sure:

image

I've also manually validated the user's confirmation mail just to make sure it cannot cause this warning message.

Since both my token and the user seem to be valid, I've tried to debugg the plugin. There is this plugin.settings.name (default: appId) : I don't understand its purpose. I think I haven't correctly configured it. Since it's used to build hashes like plugin.settings.name + ':uid', I've tried it using "username" and "user" but it didn't work.

I'm new to NodeBB and I know these hashes are here to mimic relations but I don't understand it completely.

julianlam commented 6 years ago

The way the plugin works to associate a JWT with a user account is to do these checks:

  1. If there is a relation in appId:uid, then log in to that user
  2. If not, then it is likely a new user, so check if the email in the JWT is found in the database (email:uid). If so, log into that user.
  3. If not, then create new user and add to appId:uid.

If you've created a user locally in NodeBB, there's no way to associate that existing user via JWT unless the email matches, or if you manually add the entry into the appId:uid sorted set.

The only function of the name config is just if you wanted to change the set name... so instead of appId:uid you could set it to whateverId and it would then save to whateverId:uid.