Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

GeneralUserSettingsTab doesn't properly handle IS token expiration #11675

Open
mjattiot opened this issue Dec 16, 2019 · 0 comments
Open

GeneralUserSettingsTab doesn't properly handle IS token expiration #11675

mjattiot opened this issue Dec 16, 2019 · 0 comments
Labels

Comments

@mjattiot
Copy link

Description

When connecting to the IS v2 API, matrix-react-sdk uses an mx_is_access_token. However I think that the expiration is not properly managed.

The expiration logic seems to happen here: https://github.com/matrix-org/matrix-react-sdk/blob/0ac4e6f5a0e5822553fb40e31fc63413154bec3b/src/IdentityAuthClient.js#L101

The function getAccessToken() uses a boolean called "check", to start the token check process and re-register for a new one if required (if the IS throws an error).

However, when navigating on Riot to the GeneralUserSettingsTab, this check argument is set to false :
https://github.com/matrix-org/matrix-react-sdk/blob/9cae685e225ea780e93d9ad42f0d594a81949b39/src/components/views/settings/tabs/user/GeneralUserSettingsTab.js#L163

I don't understand the point of not checking the token here (setting check to true). If my token expires, going to my settings dialog won't generate a new one and I will be denied by the IS server instead.

Steps to reproduce

  • Change manually mx_is_access_token in your local storage to a false one, simulating an expiration
  • On Riot, come back to your General Settings Tab
  • no call to /account/register will be triggered and therefore the call to hash_details will be denied

Describe how what happens differs from what you expected.

Logs being sent: no

Version information

  • Platform: web (in-browser)

For the web app:

  • Browser: Chrome, Safari, Firefox
  • URL: private server running 1.5.5 of riot-web?
@mjattiot mjattiot changed the title IS access token doesn't properly handle expiration GeneralUserSettingsTab doesn't properly handle is token expiration Dec 16, 2019
@mjattiot mjattiot changed the title GeneralUserSettingsTab doesn't properly handle is token expiration GeneralUserSettingsTab doesn't properly handle IS token expiration Dec 16, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant