supertokens / supertokens-website

Frontend SDK for SuperTokens - for session management + automatically refreshing sessions
https://supertokens.com
Other
54 stars 13 forks source link

Do not call recipe impl function inside another function that is unable to supply a user context to it #99

Closed rishabhpoddar closed 2 years ago

rishabhpoddar commented 2 years ago

For example, getAccessTokenPayloadSecurely calls doesSessionExist internally. So if someone overrides doesSessionExist and in that calls getAccessTokenPayloadSecurely, it leads to an infinite loop. This can be solved by providing appropriate user context values and breaking the infinite recursion loop.

However, there is a case where refreshing a session calls recipeImpl.doesSessionExist which then if it calls getAccessTokenPayloadSecurely, which can also refresh the session. This causes an infinite recursive loop where the user context is no longer passed and cannot be used to break the loop.