New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

User can end up logged into regular Hypothesis account on a page configured to use a third party account #571

Closed
robertknight opened this Issue Nov 9, 2017 · 2 comments

Comments

Projects
None yet
2 participants
@robertknight
Contributor

robertknight commented Nov 9, 2017

Steps to reproduce

  1. Run a local build of the client against a local h service
  2. Login to the client using a regular account on the local h service
  3. Run the publisher account test site https://github.com/hypothesis/publisher-account-test-site and do not login to the test site

Expected result

Client shows publisher group. User is not logged in.

Actual result

Client shows normal Hypothesis groups. User is logged in to their normal Hypothesis account.

Notes

The issue is that in this context, the host page (the publisher account test site) includes a services config for the client but the grantToken is null. If the grant token is null we fall back to trying to load access tokens from local storage.

Since the apiUrl config param is the same for this "third party service" as it is for the regular Hypothesis service, the storageKey() function returns the same key that was used to store OAuth tokens for the regular Hypothesis service.

Consequently the client ends up using the saved access token and the user ends up logged in to their regular Hypothesis account.

@robertknight robertknight changed the title from Client uses OAuth tokens for Hypothesis accounts when a third-party service hosted by Hypothesis is configured but no grant token is provided to User can end up logged into regular Hypothesis account on a page configured to use a third party account Nov 9, 2017

@seanh

This comment has been minimized.

Show comment
Hide comment
@seanh

seanh Nov 13, 2017

Contributor

At least on the publisher account site the log out button also doesn't work, when I'm logged in to a first-party account on the publisher site

Contributor

seanh commented Nov 13, 2017

At least on the publisher account site the log out button also doesn't work, when I'm logged in to a first-party account on the publisher site

@seanh

This comment has been minimized.

Show comment
Hide comment
@seanh

seanh Nov 13, 2017

Contributor

Confirmed that I can reproduce this

Contributor

seanh commented Nov 13, 2017

Confirmed that I can reproduce this

@seanh seanh closed this in #572 Nov 21, 2017

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment