oroinc / platform

Main OroPlatform package with core functionality.
Other
627 stars 351 forks source link

Websocket connection not authenticated after changing password #1079

Open hvanoch opened 2 years ago

hvanoch commented 2 years ago

Summary
Websocket connection is not authenticated properly when changing password and refreshing the page.

Steps to reproduce

  1. Login
  2. Open devtools
  3. Change password of logged in user
  4. Refresh the page

Actual Result

Console prints error:

Uncaught SyntaxError: Unexpected token H in JSON at position 0
    at JSON.parse (<anonymous>)

Expected Result
Websocket connection is authenticated

Details about your environment

Additional information
Issue is that once the user is loaded in the entity manager, during the websocket server runtime, it is never refreshed from the database. So it will still use the old password (hash) for creating the ticket digest. Reference: oro/platform/src/Oro/Bundle/SyncBundle/Security/TicketAuthenticationProvider.php:122 image

webevt commented 2 years ago

Thank you for your report, @hvanoch

Internal ticket id #BAP-21278.