kalisio / kano

Map and weather forecast data explorer in 2D/3D
https://kalisio.github.io/kano/
MIT License
24 stars 7 forks source link

Token without user ID are not valid anymore to be used by iframe #310

Closed claustres closed 1 year ago

claustres commented 1 year ago

Kano can be used either with a local user account or embedded in others apps through an iframe. In this case, we provide the embedding app with a stateless token because authentication is managed by the embedding app with its own user accounts, this token allows the embedding app to use Kano just like if the user was also logged into. However, this token has usually no expiration date at all (or a long one) and no link with a user in the app DB. It seems that the JWT strategy allowed this in Feathers v3 but since Feathers v5 it appears that a JWT without a user ID does not work well in the default JWT strategy raising 404 error about user not found.

Related to https://github.com/kalisio/kdk/issues/699.