search

lynndylanhurley / devise_token_auth

Token based authentication for Rails JSON APIs. Designed to work with jToker and ng-token-auth.
Do What The F*ck You Want To Public License
3.54k stars 1.13k forks source link

Set cookie token on omniauth success to avoid having to store the scraped query param token in the client #1539

Closed theblang closed 2 years ago

theblang commented 2 years ago

In #1453 we added support for sending and receiving the auth token as a cookie. We're currently working on a de-angularized version of ng-token-auth with cookie support, which means we don't need to store the token in client storage anymore. But I realized that the OAuth flow still requires client storage because the token is scraped from query params, temporarily stored in client storage, then sent to the validate_token call, where a cookie is created. I realized that we could instead just create the cookie immediately in the same place that we're creating the query params in order to avoid having to leak the token in client storage just for that small initial period.

theblang commented 2 years ago

Hey @MaicolBen ! Quick question, I started to write a test for this, but when following the instructions I hit the following error:

Rails couldn't infer whether you are using multiple databases from your database.yml and can't generate the tasks for the non-primary databases. If you'd like to use this feature, please simplify your ERB.

I think this was also mentioned in #1456 . Any ideas of how I should proceed?

theblang commented 2 years ago

Going to close this PR in favor of opening a new one whose source isn't my fork's master. Need to make a similar additional change for the reset password flow.

theblang commented 2 years ago

See #1542 instead