ueberauth / guardian

Elixir Authentication
MIT License
3.44k stars 381 forks source link

fix bug where other :guardian_ keys are parsed from the conn #476

Closed tarzan closed 6 years ago

tarzan commented 6 years ago

Came accross a problem where other :guardian_ keys where being processed by the Guardian.Plug.Keys module. Other meaning: other than _claims, _token and _resource.

These other keys may, for example, have been put there by another Plug in the pipeline. In particular, this causes problems when working together with guardian_db and revoking sessions.

The test demonstrates this by constructing this:

conn.private == %{
  guardian_default_claims: %{"sub" => "bob", "typ" => "access"},
  guardian_default_resource: %{id: "bob"},
  guardian_default_token: "eyJjbGFpbXMiOnsidHlwIjoiYWNjZXNzIiwic3ViIjoiYm9iIn19",
  guardian_error_handler: Guardian.PlugTest.PipelineImpl.Handler,
  guardian_module: Guardian.PlugTest.PipelineImpl.Impl,
  plug_session: %{
    "guardian_default_token" => "eyJjbGFpbXMiOnsidHlwIjoiYWNjZXNzIiwic3ViIjoiYm9iIn19"
  },
  plug_session_fetch: :done,
  plug_session_info: :renew
}

and then calling Impl.Plug.sign_out which would subsequently not try to clear the key :guardian_error_handler from the session with this fix.

hassox commented 6 years ago

Can you please update the changelog before I merge this.

tarzan commented 6 years ago

Rebased and updated the changelog (added my previous PR to the changelog as well, hope you don't mind).

hassox commented 6 years ago

Thank you :)