open.source/manifold
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Properly handle expired ID token cookie, be robust to errors (#671)

Browse Source
This commit is contained in:
Marshall Polaris 2022-07-19 20:08:33 -07:00 committed by GitHub
parent b2c89d36cf
commit 61094ea17d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
web/lib/firebase/server-auth.ts
View File

@ -52,12 +52,19 @@ export const getServerAuthenticatedUid = async (ctx: RequestContext) => {
if (idToken != null) { if (idToken != null) {
try { try {
return (await auth.verifyIdToken(idToken))?.uid return (await auth.verifyIdToken(idToken))?.uid
} catch {
// plausibly expired; try the refresh token, if it's present
}
}
if (refreshToken != null) {
try {
const resp = await requestFirebaseIdToken(refreshToken)
setAuthCookies(resp.id_token, resp.refresh_token, ctx.res)
return (await auth.verifyIdToken(resp.id_token))?.uid
} catch (e) { } catch (e) {
if (refreshToken != null) { // this is a big unexpected problem -- either their cookies are corrupt
const resp = await requestFirebaseIdToken(refreshToken) // or the refresh token API is down. functionally, they are not logged in
setAuthCookies(resp.id_token, resp.refresh_token, ctx.res) console.error(e)
return (await auth.verifyIdToken(resp.id_token))?.uid
}
} }
} }
return undefined return undefined