Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix issue that could lead to user being logged into normal Hypothesis account on websites using third-party accounts #572

Merged
merged 2 commits into from Nov 21, 2017
Merged

Fix issue that could lead to user being logged into normal Hypothesis account on websites using third-party accounts #572

merged 2 commits into from Nov 21, 2017

Commits on Nov 13, 2017

  1. Fix handling of persisted OAuth tokens for anonymous third-party users 

    When automatic login to a third-party account is being used, via a grant
token, OAuth tokens persisted by other client sessions should not be
used.

Fix this in the case where the user is anonymous on the publisher's
website and so the publisher will have set the "grantToken" property in
the "services" array to `null`.

Also add a test for the case where the user is logged in and the grant
token is a JWT (although opaque to the client). This case was already
working.
    @robertknight @seanh
    robertknight authored and seanh committed Nov 13, 2017
    Copy the full SHA
    fda9286 View commit details
    Browse the repository at this point in the history

  2. Do not persist refreshed tokens if the original token was temporary 

    If the initial access token was acquired via an automatic login using a
grant token provided by the publisher, neither the initial access token
nor refreshed tokens should be persisted to local storage.
    @robertknight @seanh
    robertknight authored and seanh committed Nov 13, 2017
    Copy the full SHA
    ea7f5e4 View commit details
    Browse the repository at this point in the history