Summary
Websocket connection is not authenticated properly when changing password and refreshing the page.
Steps to reproduce
Login
Open devtools
Change password of logged in user
Refresh the page
Actual Result
Console prints error:
Uncaught SyntaxError: Unexpected token H in JSON at position 0
at JSON.parse (<anonymous>)
Expected Result
Websocket connection is authenticated
Details about your environment
OroPlatform version: 4.2.9
PHP version: 8.0.16
Additional information
Issue is that once the user is loaded in the entity manager, during the websocket server runtime, it is never refreshed from the database. So it will still use the old password (hash) for creating the ticket digest.
Reference: oro/platform/src/Oro/Bundle/SyncBundle/Security/TicketAuthenticationProvider.php:122
Summary
Websocket connection is not authenticated properly when changing password and refreshing the page.
Steps to reproduce
Actual Result
Console prints error:
Expected Result
Websocket connection is authenticated
Details about your environment
Additional information![image](https://user-images.githubusercontent.com/6741991/157256218-7ca57f63-ca0e-418b-9792-fc234c75b778.png)
Issue is that once the user is loaded in the entity manager, during the websocket server runtime, it is never refreshed from the database. So it will still use the old password (hash) for creating the ticket digest. Reference:
oro/platform/src/Oro/Bundle/SyncBundle/Security/TicketAuthenticationProvider.php:122