Fixed server crash bug when tokens not found in db #230
Conversation
… db check during access token validation, and added additional test for refactoring
There was a problem hiding this comment.
Tested manually and ran all the tests, all good.
I'm glad you figured out how to reproduce the error I've completed forgotten to put that in and I've also forgotten how to trigger the error to test it 😂
Just need a small change on the changelog, since this didn't get merged before the release.
cherylli
requested review from
JoshuaHinman
and removed request for
JoshuaHinman
|
@andram11 could you please resolve merge conflicts when you have a chance? Thanks! |
|
hey @andram11, I noticed from the last couple of PR the changelog entries were in the wrong place, when you resolve conflict could you please update it like below? Thanks |
cherylli
requested review from
JoshuaHinman,
timDeHof,
davideastmond,
jenny-alexander and
Ajen07
and removed request for
curtwl and
JoshuaHinman
|
remove all changes to the changelog, since we've stopped manually updating changing |
| @@ -34,20 +34,24 @@ export class AtStrategy extends PassportStrategy(Strategy, "jwt-at") { | |||
| } | |||
|
|
|||
| async validate(payload: any) { | |||
| const userInDb = await this.usersService.getUserRolesById(payload.sub); | |||
| //Get user roles | |||
There was a problem hiding this comment.
Would it be helpful to annotate the return type of this validate method? It looks like it would be Promise<UserReq | undefined>
There was a problem hiding this comment.
I was able to replicate issue and get a 500 response.
After checking out these changes, I ran 'npm run seed' and accessed GET endpoint /api/v1/teams, received 401 error.
@cherylli - I get 401 (unauthorized) but the PR description explicitly states getting 403 (forbidden). I approved the PR anyway since this might be a typo in the PR text itself?
yeah 401 makes more sense since the user is not logged in. I think I got 401 too, then the user will be required to relogin in this case |
Description
Fix for bug: cannot read properties of undefined when user is logged in but database re-seeded, and user is still logged in (still has access and refresh tokens) and tries to access non public endpoints.
Issue link
Fixes bug
Type of change
How Has This Been Tested?
Before fix, I log in with a user and have an access & refresh token.
If I shut down server and reseed the database, then I try to access a non public endpoint (like get forms by id) using the access & refresh token, I received an http 500 Internal Server Error. In logs there is a 'cannot read properties of undefined'(reading 'map')...After some time, when the token expires, I get the usual 403 error. This error occurs because when treating the JWT token, we were retrieving the roles of a user even though the user id no longer existed in the db (after reseed). As such, the roles were undefined which caused issues when calculating the abilities of user.
After fix, If i reseed and use old access & refresh token I just get a 403.
Checklist: