ueberauth / guardian

Elixir Authentication
MIT License
3.43k stars 379 forks source link

refresh_from_cookie only accepts "default" as key #722

Closed iamjoshleung closed 1 year ago

iamjoshleung commented 1 year ago

Steps to Reproduce

conn
        |> Plug.Conn.put_session(:account_id, account.id)
        |> put_status(:ok)
        |> put_resp_cookie("guardian_jwt_token", token, http_only: true)
        |> render(:account_token, %{account: account, token: token})
defmodule ElixirAuthWeb.Auth.Pipeline do
  use Guardian.Plug.Pipeline, otp_app: :elixir_auth,
  module: ElixirAuthWeb.Auth.Guardian,
  error_handler: ElixirAuthWeb.Auth.GuardianErrorHandler

  plug Guardian.Plug.VerifySession, refresh_from_cookie: [key: "jwt"]
  plug Guardian.Plug.VerifyHeader, refresh_from_cookie: [key: "jwt"]
  plug Guardian.Plug.EnsureAuthenticated
  plug Guardian.Plug.LoadResource
end

If I set the cookie key to guardian_default_token and use [key: "default"] then it works. But if I set it to guardian_jwt_token and use [key: "jwt"] then it fails. And honestly the whole key thing is very confusing. Why should I need to know guardian_jwt_token is the default key by reading the code? It's never mentioned in the docs. It only mentions The location of the token (default :default) Second thing is, I need to set [key: "jwt"] instead of [key: "guardian_jwt_token"]? That means I need to know the inner working of the codebase in order to use this functionality. On the hexdocs, :key is described as The location of the token. Doesn't "The key of the token stored in cookies" or something like that seem more intuitive? I honestly didn't understand what The location of the token meant at the first glance because The location of the token is cookies when it actually means The key of the token.

Expected Result

Successful authentication

Actual Result

:unauthenticated

yordis commented 1 year ago

refresh_from_cookie is a boolean, https://github.com/ueberauth/guardian/blob/eafa1e430c9c75b0768a9fd72b18021187d2e15b/lib/guardian/plug/verify_header.ex#L39

use key https://github.com/ueberauth/guardian/blob/eafa1e430c9c75b0768a9fd72b18021187d2e15b/lib/guardian/plug/verify_header.ex#L37

  plug Guardian.Plug.VerifySession, refresh_from_cookie: true, key: "jwt"
  plug Guardian.Plug.VerifyHeader, refresh_from_cookie: true, key: "jwt"

I will suggest asking for help in the Slack channel or using the Discussion