Auth0: don't ask users to re-login everyday

openwhyd / openwhyd

💎 Like Pinterest, but for Music 🎧

https://openwhyd.org/

MIT License

401 stars 74 forks source link

Auth0: don't ask users to re-login everyday #765

Open adrienjoly opened 8 months ago

adrienjoly commented 8 months ago

Describe the bug Since we migrated authentication to auth0 (cf PR #705), users need to re-login everyday. Which is especially annoying when it happens on the downloadable electron app, because it's not possible to use the browser's password manager.

adrienjoly commented 8 months ago

First (failed) attempt

I tried fixed this problem by adding attemptSilentLogin: true to Auth0 init settings, but had to revert it immediately because trying to play a YouTube video after that would result in a checks.state argument is missing error in the player's area:

adrienjoly commented 8 months ago

Root cause analysis

That error was visible in server logs, whenever I tried to play a YouTube track, even after reverting the commit, resetting cookie and re-logging:

❌ Error -- Sat, 09 Mar 2024 13:43:31 GMT BadRequestError: checks.state argument is missing
    at ResponseContext.callback (/home/adrien/openwhyd/node_modules/express-openid-connect/lib/context.js:347:15)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)

I found that it could be triggered directly by opening the iframe's target of the YouTube embed:

adrienjoly commented 8 months ago

Resolution

After reverting the commit, invalidating cloudfront's cache for that file solved the issue.

adrienjoly commented 8 months ago

Post mortem

Hypothesis:

assuming that auth0's session is checked even for public assets, including https://openwhyd.org/html/YoutubePlayerIframe.html
for some reason, adding attemptSilentLogin: true made cloudfront-cached /html/YoutubePlayerIframe.html page call openwhyd.org/callback with missing (but expected) auth cookies, causing the checks.state argument is missing error

adrienjoly commented 8 months ago

Second attempt

From https://manage.auth0.com/dashboard/eu/openwhyd/applications/2bQPQT4zHVg2mKYR0uqk8rf5ItisvSWx/settings, set ID Token expiration from 36000 seconds (= 10 hours) to 1 week == 7243600 == 604800 seconds