LiveChat: Showing registration form after ending the chat

[arikusu]

Description:

Currently, when a guest user tries to end the chat, livechat:closeByVisitor closes the room only.

In shared / public computers, this results in a security risk, since the initial guest user is not destroyed (or logged out), the new comer impersonates the first user and can open a new session/room with the initial user's registration information.

We would need a way to "logout" the guest user and reload the registration form.

Server Setup Information:

• Version of Rocket.Chat Server: 0.60-rc1

Steps to Reproduce:

1. Open a livechat session after registration
2. End the chat session

Expected behavior:

Close the session for the guest user and show the new registration form.

Actual behavior:

A new user can continue to chat with the first user's registration information / token etc.

[sampaiodiego]

I agree this is an issue for shared/public computers, but for the majority use case (personal computers) I think showing the registration form again is bad UX..

since we cannot guess if the visitor is on a shared or personal computer, do you think having a setting which when enabled will force the visitor to register itself again always is good enough?

[arikusu]

Hi @sampaiodiego

Strongly agree that it would be a bad UX showing registration form on every chat session end.

I would suggest two things for that

• A logout button separate from "end chat", this will help any guest user (either on public/shared or personal computer)
• A setting as you described maybe with a configurable session timeout duration

Other than that, I tried deleting keys in localStorage as described in #8097 and reloading the iframe with no luck.
Do we need your PR #9048 about decoupling the users?

If you have any suggestions to implement, I may work on my first PR ;)

Thank you

[sampaiodiego]

@arikusu the snippet from #8097 does not looks it may work.. as a workaround you should try localStorage.clear() , but remember to the change the target on browser's console (otherwise you will not run the code within the iframe):

If you want to implement a real solution though I suggest you to log out the user by calling Meteor.logout() but I think you'll need to somehow trigger something to show the register form again 😬

after #9048 is merged you will not be able to log out the user because it will not be a real user.. but this means it will be easier to implement =)

[MartinSchoeler]

This feature was added in RocketChat/Rocket.Chat.Livechat#666

So I'll be closing this. Thanks!