Make sure my signout is a real signout #253

douglasnaphas · 2020-11-21T17:09:32Z

I think I currently have a halfhearted signout, that leaves the cookies in place.

douglasnaphas · 2020-11-21T17:10:33Z

Relates to #248.

douglasnaphas · 2021-02-05T03:59:08Z

Reference

douglasnaphas · 2021-05-29T02:29:57Z

This definitely belongs in v4.

douglasnaphas · 2021-06-07T00:43:41Z

I should set an expiration time on the cookies, in case people don't actively logout.

douglasnaphas · 2021-06-07T07:18:02Z

I should make sure there's an expiration date on my non-JWT cookies as well.

douglasnaphas · 2021-08-15T06:27:39Z

TODO

~~Add /get-cookie to backend, issuing an opaque cookie. It would be OK, though ambitious, to add this as a synchronous EventBridge/Step Functions workflow~~ CDK support for APIGW-StepFunctions integration isn't sufficient. Also, I'm going to add opaque cookie issuing and checking to the existing login- and cookie-related endpoints, and then delete the unnecessary JWT-related code from those same endpoints.
Handle the case where the person is in no seders at /#/seders (Spinner just spins at /#/seders if no seders are joined #264).
Add opaque cookie issuing and handling to existing login- and cookie-related endpoints.
Delete unnecessary JWT-related code from login/cookie endpoints.
~~Add a /clear-cookies endpoint~~ I'll add opaque cookies onto the existing endpoints, to make for an easier transition.
Add a /clear-jwts endpoint. Maybe (probably) rename it to /clear-cookies.
- Make a test of /clear-jwts using supertest.
Make the logout button on the frontend hit ~~/clear-jwts~~ /clear-cookies.
- Make a failing unit test checking whether the Log Out button is inactive until ~~/clear-jwts~~ /clear-cookies returns.
- Get the Log Out unit test passing.
- Run the e2e test locally against the deployed dev site.
- Make the e2e test look for ~~JWTs~~ the opaque cookie in the logged-in browser after the game is over. I'll need to use Network.getAllCookies to get the ~~JWTs~~ cookie, as it and my ~~other~~ legacy cookies are HttpOnly. I can get them with var data = await page._client.send('Network.getAllCookies');.
Make the e2e test click logout.
Make the e2e test check for expired ~~JWT~~ cookies, and fail. I'm not sure what this will look like.
Set an expiration date on all cookies. There wasn't really ever an advantage to me using session cookies anyway.
Switch from the old cookies to the new cookie.
Add a madliberation user id. Or maybe the email address, normalized to lowercase, is the user id.
Separate endpoints for, eg, /join-seder and /join-seder-signed-in. Otherwise endpoints could partially succeed.
Use lambda authorizers. Or APIGW cookie (?) authorizes? Probably not. Or maybe... Maybe I could use a Cognito authorizer for the path that turns Cognito cookies into ML cookies, and a Lambda authorizer for paths that require sign-in. The main drawback of Lambda authorizers was that they only offer authorization based on a token or request params, but not both, and I want to use both so that the front end and back end are always on the same page about who the user is, but I could do that part in the app code. There's also the issue of WS APIs only allowing request param auth.
Delete legacy cookie code.
Gracefully handle what happens if someone tries an authenticated action with no cookies
What about if someone's opaque cookie expires while they're midway through an authenticated seder?
Add a Smoke Action (efcbd13) so that the hastened itest from this branch can become permanent

douglasnaphas · 2021-08-15T17:37:18Z

On deleting cookies server-side (set Expires in the past).

douglasnaphas · 2021-09-03T04:39:48Z

I'm re-prioritizing this ahead of WebSockets. I think I only temporarily put WebSockets ahead of it because I was curious whether the WebSocket connect handler receives cookies. It does.

douglasnaphas · 2021-09-04T01:59:43Z

I'm still continuing work for this on the 250-ws1 branch for now, though.

douglasnaphas · 2021-09-04T02:37:05Z

What about users who still have old cookies in their browsers for Passover 2022?

gh-253

gh-253 My last build failed when it tried to curl a host of https

gh-253

douglasnaphas · 2021-12-12T06:01:49Z

Do I even need access and refresh tokens? I'm not delegating authorization like with OAuth2.0. Should I be issuing my own cookie? If I do, what happens when it expires? How about...it's expired, and the person has to log in again. I bet my frontend doesn't handle that course of events (expired cookies of any kind) at all.

douglasnaphas · 2021-12-17T23:36:00Z

I think a big part of the whole problem around signout, gh-331, etc, is that my frontend is confused about who is signed in. It should, as part of this or any of this batch of Issues:

Ask the backend on each load for an authoritative decision about whether the cookie sent with the request is for a logged-in user, and if so, the logged-in user's email address.
If they're not a logged-in user, but they once were (?), like if the cookie is found but expired (but if I'm expiring cookies by a cookie attribute, an expired cookie will never get sent, so I won't be able on the backend to distinguish between a user who logged in too long ago and a user who has never logged in), or if some state on the front end claims that the user is logged in, then they should go to a you-have-been-logged-out page.

douglasnaphas · 2021-12-19T04:43:28Z

Ugh, what if someone logs in, joins a seder, logs out in another tab, and submits their libs in the tab where they're logged in?

douglasnaphas · 2021-12-19T06:33:13Z

I should stop sending the id token to the client, and instead associate the identity server-side with the…sub? Id token on the client creates multiple sources of truth.

douglasnaphas · 2021-12-19T15:27:12Z

The whole login/logout behavior is getting really hard to manage. I think I need to list all the different features I want, how I want it to work.

douglasnaphas · 2021-12-29T05:33:32Z

I think I do want to move to a passover.lol-generated opaque cookie. Advantages:

Less noise in the dev tools.
Less data sent around.
Less backend complexity because I can throw out the refresh token logic. I can just have the opaque cookie last as long as I want it to, that is, as long as the refresh token would have been valid for. When the opaque cookie expires, they're logged out, just as they would have been whenever their refresh token expired.
Less backend complexity around cookie-checking after initial login.
No more abuse of access tokens--I should not be using OAuth2 access and refresh tokens because I'm not doing delegation of authorization.

I should still, during the cookie-checking process, check back with Cognito to see if the person has deleted their user.

douglasnaphas · 2021-12-29T05:34:23Z

Side note: maybe the backend auth'd user recordkeeping should be limited to "this email address was this user in these rooms."

gh-253 Since I'm planning to mess with cookies, I want signin exercised on this dev branch. I may leave these changes to the itest App in place on master, and add a Smoke Action that runs the smoke test every day.

gh-253

douglasnaphas · 2022-03-15T18:00:31Z

The login cookie should be non-session.

gh-253

gh-253 I don't know how to do what the commented-out test here is doing. I don't know how to test that my runXXX Dynamo functions actually set the locals they're supposed to set.

gh-253 This actually tests that, when I have a function like runGet that runs a DynamoDB get(), the locals like dbError and dbData are set.

gh-253

gh-253 I'm getting a real error on authenticated requests, a db error when trying to get the email.

gh-253

douglasnaphas · 2022-03-16T02:19:00Z

I'm quite worried about how the front-end will handle expired logins.

gh-253

gh-253 We authenticate with the email now, not the sub.

douglasnaphas · 2022-03-16T02:44:29Z

TODO 2022-03-15

Get rid of the front-end's call to /id. Get the nickname and email from the URL instead.
Banish sub from the front-end.
Have the frontend reasonably handle expired sign-ins. I might have adequate instructions already, since I think with some 400s I say "if you are logged in, try logging out," "try in a different browser," etc.

gh-253 The evaluate happens in the browser, so it doesn't know user2's name unless I pass it in.

gh-253 I started sending more 400s rather than 401s, because the 401 docs say something about you must send instructions on how to authenticate.

gh-253 We’ll get the user info from the URL.

gh-253 I run itest with npx now.

gh-253

gh-253 The front-end now never interacts with JWTs.

gh-253

gh-253 The frontend now figures out who is logged in by looking at params sent back after login in the redirected-to URL, not by hitting /id.

douglasnaphas · 2022-03-17T13:48:26Z

I might need to bring back some kind of /id endpoint. If you load a new page after signing in, and you have a valid cookie in your browser, you could be kind of signed in without your UI telling you that you are. This could probably be addressed after web sockets, because you aren't really signed in when this happens. The front end has to affirmatively include the email address in requests, even if there is a valid cookie, for anything to happen on behalf of the user. This appears to be addressed in recent commits, in which I update the state hydration to look for just email and nickname.

douglasnaphas · 2022-03-18T02:15:49Z

gh-400 is created to handle invalidating the opaque cookie server-side.

douglasnaphas mentioned this issue Nov 21, 2020

What are all these cookies? #248

Open

douglasnaphas mentioned this issue May 30, 2021

Make sure the the backend is properly issuing new access tokens cdk-turnkey/brian-liberation#14

Open

douglasnaphas mentioned this issue May 30, 2021

Delete cookies on logout cdk-turnkey/brian-liberation#18

Open

douglasnaphas mentioned this issue Aug 15, 2021

Some users got an incurably disabled Join Seder button after entering their names #331

Open

douglasnaphas added a commit that referenced this issue Sep 5, 2021

Validate /clear-jwts in itest

b0cc701

gh-253

douglasnaphas added a commit that referenced this issue Sep 5, 2021

Debug itest, print APP_URL

c1d3d45

gh-253 My last build failed when it tried to curl a host of https

douglasnaphas added a commit that referenced this issue Sep 5, 2021

Curl https://HOST, not https://https://HOST

fb7fb66

gh-253

douglasnaphas added a commit that referenced this issue Sep 7, 2021

Make sure the cookie expiry itest works

2ed900d

gh-253

douglasnaphas added a commit that referenced this issue Mar 15, 2022

Shift to a Put/GetItem approach for opaque cookie

9253605

gh-253

douglasnaphas added a commit that referenced this issue Mar 15, 2022

Implement dbParamsGetEmailFromOpaqueCookie

10ac4f4

gh-253

douglasnaphas added a commit that referenced this issue Mar 15, 2022

Put the login cookie info in Dynamo

d2613b8

gh-253

douglasnaphas added a commit that referenced this issue Mar 16, 2022

Add runGet

4871471

gh-253 I don't know how to do what the commented-out test here is doing. I don't know how to test that my runXXX Dynamo functions actually set the locals they're supposed to set.

douglasnaphas added a commit that referenced this issue Mar 16, 2022

Finally test that runXXX functions work

5253ecf

gh-253 This actually tests that, when I have a function like runGet that runs a DynamoDB get(), the locals like dbError and dbData are set.

douglasnaphas added a commit that referenced this issue Mar 16, 2022

Note TODO for testing Dynamo functions

f4b13ef

gh-253

douglasnaphas added a commit that referenced this issue Mar 16, 2022

Shift to authentication with the opaque cookie

d403f2d

gh-253

douglasnaphas added a commit that referenced this issue Mar 16, 2022

Supply required args to runGet

97a2f98

gh-253

douglasnaphas added a commit that referenced this issue Mar 16, 2022

Correct the name to the dbError

04c4168

gh-253 I'm getting a real error on authenticated requests, a db error when trying to get the email.

douglasnaphas added a commit that referenced this issue Mar 16, 2022

Specify the sort key when getting the email

05d746d

gh-253

douglasnaphas added a commit that referenced this issue Mar 16, 2022

Return next() on successful authentication

5672ae4

gh-253

douglasnaphas added a commit that referenced this issue Mar 16, 2022

Include the email with authed fetches in itest

73946a9

gh-253 We authenticate with the email now, not the sub.

douglasnaphas added a commit that referenced this issue Mar 16, 2022

Pass the username to the evaluate call

2096522

gh-253 The evaluate happens in the browser, so it doesn't know user2's name unless I pass it in.

douglasnaphas added a commit that referenced this issue Mar 16, 2022

Expect any 4xx status in itest

2f43899

gh-253 I started sending more 400s rather than 401s, because the 401 docs say something about you must send instructions on how to authenticate.

douglasnaphas added a commit that referenced this issue Mar 16, 2022

Remove fetch, LoggingInPage.test

6cfd21d

gh-253 We’ll get the user info from the URL.

douglasnaphas added a commit that referenced this issue Mar 16, 2022

Remove itest Dockerfile

c3b3661

gh-253 I run itest with npx now.

douglasnaphas added a commit that referenced this issue Mar 16, 2022

Do LoggingInPage without fetch

1bfdd85

gh-253

douglasnaphas added a commit that referenced this issue Mar 17, 2022

Remove sub uses: Home, itest, App, Gen~RoomCode

7076029

gh-253

douglasnaphas added a commit that referenced this issue Mar 17, 2022

Remove use of sub in SedersPage

37fa53a

gh-253

douglasnaphas added a commit that referenced this issue Mar 17, 2022

Remove unused JWT-saving function

30f800b

gh-253 The front-end now never interacts with JWTs.

douglasnaphas added a commit that referenced this issue Mar 17, 2022

Remove sub reference from joinSeder

af8e527

gh-253

douglasnaphas added a commit that referenced this issue Mar 17, 2022

Remove unused /id endpoint

6b0a77c

gh-253 The frontend now figures out who is logged in by looking at params sent back after login in the redirected-to URL, not by hitting /id.

douglasnaphas mentioned this issue Mar 17, 2022

Sign out for real, use an opaque cookie #399

Merged

douglasnaphas closed this as completed Mar 18, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Make sure my signout is a real signout #253

Make sure my signout is a real signout #253

douglasnaphas commented Nov 21, 2020

douglasnaphas commented Nov 21, 2020

douglasnaphas commented Feb 5, 2021

douglasnaphas commented May 29, 2021

douglasnaphas commented Jun 7, 2021

douglasnaphas commented Jun 7, 2021

douglasnaphas commented Aug 15, 2021 •

edited

Loading

douglasnaphas commented Aug 15, 2021 •

edited

Loading

douglasnaphas commented Sep 3, 2021

douglasnaphas commented Sep 4, 2021

douglasnaphas commented Sep 4, 2021

douglasnaphas commented Dec 12, 2021

douglasnaphas commented Dec 17, 2021

douglasnaphas commented Dec 19, 2021

douglasnaphas commented Dec 19, 2021

douglasnaphas commented Dec 19, 2021

douglasnaphas commented Dec 29, 2021

douglasnaphas commented Dec 29, 2021

douglasnaphas commented Mar 15, 2022

douglasnaphas commented Mar 16, 2022

douglasnaphas commented Mar 16, 2022 •

edited

Loading

douglasnaphas commented Mar 17, 2022 •

edited

Loading

douglasnaphas commented Mar 18, 2022

Make sure my signout is a real signout #253

Make sure my signout is a real signout #253

Comments

douglasnaphas commented Nov 21, 2020

douglasnaphas commented Nov 21, 2020

douglasnaphas commented Feb 5, 2021

Reference

douglasnaphas commented May 29, 2021

douglasnaphas commented Jun 7, 2021

douglasnaphas commented Jun 7, 2021

douglasnaphas commented Aug 15, 2021 • edited Loading

TODO

douglasnaphas commented Aug 15, 2021 • edited Loading

douglasnaphas commented Sep 3, 2021

douglasnaphas commented Sep 4, 2021

douglasnaphas commented Sep 4, 2021

douglasnaphas commented Dec 12, 2021

douglasnaphas commented Dec 17, 2021

douglasnaphas commented Dec 19, 2021

douglasnaphas commented Dec 19, 2021

douglasnaphas commented Dec 19, 2021

douglasnaphas commented Dec 29, 2021

douglasnaphas commented Dec 29, 2021

douglasnaphas commented Mar 15, 2022

douglasnaphas commented Mar 16, 2022

douglasnaphas commented Mar 16, 2022 • edited Loading

TODO 2022-03-15

douglasnaphas commented Mar 17, 2022 • edited Loading

douglasnaphas commented Mar 18, 2022

douglasnaphas commented Aug 15, 2021 •

edited

Loading

douglasnaphas commented Aug 15, 2021 •

edited

Loading

douglasnaphas commented Mar 16, 2022 •

edited

Loading

douglasnaphas commented Mar 17, 2022 •

edited

Loading