@W-15248536@ - [v2] Google Search Console fix createCodeVerifier #1765
Conversation
| @@ -52,7 +52,8 @@ | |||
| "react-helmet": "^6.1.0", | |||
| "react-hook-form": "^6.15.8", | |||
| "react-intl": "^5.25.1", | |||
| "react-router-dom": "^5.3.4" | |||
| "react-router-dom": "^5.3.4", | |||
| "seedrandom": "^3.0.5" | |||
There was a problem hiding this comment.
don't forget to file 3pp
There was a problem hiding this comment.
The seedrandom 3PP was already filed and approved via the new Intake UI.
| @@ -124,7 +124,7 @@ const runGenerator = () => { | |||
|
|
|||
| const extension = process.platform === 'win32' ? '.cmd' : '' | |||
| const npm = `npm${extension}` | |||
| const foundNpm = cp.spawnSync(npm, ['-v']).stdout.toString().trim() | |||
| const foundNpm = cp.spawnSync(npm, ['-v'], {shell: true}).stdout.toString().trim() | |||
There was a problem hiding this comment.
This change doesn't look related.. what and why did we make this change?
There was a problem hiding this comment.
Do we need to mention this in a change log anywhere fixing a bug I suspect?
There was a problem hiding this comment.
Correct. It's an unrelated change. I added details to the PR description.
After the latest v2 release, the Windows GA builds were failing on v2, and it seems like we decided not to fix it at that time. So I included the fix in this PR.
https://github.com/SalesforceCommerceCloud/pwa-kit/tree/release-2.8.x
https://github.com/SalesforceCommerceCloud/pwa-kit/actions/runs/8731228868/job/23956306359
Extra: Fix failing GitHub Actions Windows builds
Node.js issue: nodejs/node#52554The latest security fix on Node.js on Windows blocks the spawSync .cmd unless { shell: true } is used.
Good call on adding the change to the change log.
Description
Problem
When Google crawler calls createCodeVerifier() to create the code verifier we use for the PKCE authentication flow, the result from nanoid() is the same in two different runs. This causes the same generated code_challenge to be used twice thus Google crawler gets the error stating that the PKCE code_challenge must be unique error.
The root of this issue is the fact that Googlebot’s implementation of random() is deterministic, meaning that it won’t produce unique random values from one string of runs to the next.
The result is that Google crawler indexes the error page instead of the proper page.
Solution
Add entropy to nanoid() using the library
seedrandomto avoid duplicated code_challenge sent to SCAPI by Google crawler browser.Nanoid docs on Custom Random Bytes Generator.
Extra: Fix failing GitHub Actions Windows builds
Node.js issue: nodejs/node#52554
The latest security fix on Node.js on Windows blocks the spawSync .cmd unless
{ shell: true }is used.Types of Changes
Changes
How to Test-Drive This PR
Checklists
General
Accessibility Compliance
You must check off all items in one of the follow two lists:
or...
Localization