Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Implement user token persistency #370

Merged
merged 1 commit into from
Jun 16, 2016
Merged

Implement user token persistency #370

merged 1 commit into from
Jun 16, 2016

Conversation

xPaw
Copy link
Member

@xPaw xPaw commented May 31, 2016

Fixes #26.

It also regenerates the token on password change, which will force all your devices (except the one you changed the password on) to re-login.

@xPaw xPaw added Type: Feature Tickets that describe a desired feature or PRs that add them to the project. Type: Security Security concern or PRs that must be reviewed with extra care regarding security. labels May 31, 2016
@xPaw xPaw added this to the 2.0.0 milestone May 31, 2016
xPaw
xPaw reviewed May 31, 2016
View reviewed changes
src/server.js
@@ -239,12 +244,12 @@ function auth(data) {
if (success) {
var token;
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Forgot to remove this variable as I removed the need to pass around token into init.

@xPaw xPaw force-pushed the xpaw/persistent-token branch 2 times, most recently from 7e0c69c to f35879a Compare June 1, 2016 19:30
@maxpoulin64 maxpoulin64 self-assigned this Jun 2, 2016
maxpoulin64
maxpoulin64 reviewed Jun 2, 2016
View reviewed changes
src/server.js
@@ -206,7 +211,7 @@ function reverseDnsLookup(socket, client, token) {
client.hostname = client.ip;
}

init(socket, client, token);
init(socket, client, remember);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a reason why this isn't just handled on the client? That way, we could get rid of the remember variable entirely and not need to pass it around at all. Since that flag comes from the client anyway, I don't see any harm in always returning the token.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would need to store it somewhere while auth is happening (or disable the checkbox). I'd rather keep it as it is for now.

@xPaw xPaw force-pushed the xpaw/persistent-token branch from f35879a to b06a58b Compare June 3, 2016 11:31
@xPaw xPaw force-pushed the xpaw/persistent-token branch from b06a58b to 4c58ef4 Compare June 12, 2016 15:11
@astorije astorije mentioned this pull request Jun 12, 2016
Merged
astorije
astorije reviewed Jun 12, 2016
View reviewed changes
client/js/lounge.js
@@ -129,6 +129,11 @@ $(function() {
feedback.hide();
});
}

if (data.token && window.localStorage.setItem("token") !== null) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think you meant getItem, no? Also, shouldn't that token change only happen if data.success?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

data.token will be sent only on data.success anyway, so the check won't pass. And yes it should be getItem.

@astorije
Copy link
Member

@xPaw, can we add a text when changing the password (e.g. under the form for the UI, confirmation message when calling the CLI command) saying "[For security purposes,] all your other sessions will be logged out" or something like that? I'll let you or any native speakers decide on the wording.

@astorije astorije self-assigned this Jun 13, 2016
@xPaw xPaw force-pushed the xpaw/persistent-token branch from 4c58ef4 to 9384cd9 Compare June 13, 2016 07:34
@xPaw
Copy link
Member Author

xPaw commented Jun 13, 2016

@astorije Added a message when changing the password on web. It doesn't make much sense to keep in CLI (maybe worth mentioning on website documentation though).

@astorije
Copy link
Member

@astorije Added a message when changing the password on web.

I'd rather see something showing up in advance rather than "ah ah, you are now disconnected everywhere, sucks to be you", but we can always improve later.

👍 and merging, awesome work @xPaw!

@astorije astorije merged commit cfdcd40 into master Jun 16, 2016
@astorije astorije deleted the xpaw/persistent-token branch June 16, 2016 06:13
maxpoulin64 added a commit to maxpoulin64/thelounge that referenced this pull request Jun 19, 2016
@maxpoulin64
Fix crash in public mode introduced by thelounge#370
ffef8c5
maxpoulin64 added a commit to maxpoulin64/thelounge that referenced this pull request Jun 19, 2016
@maxpoulin64
Fix crash in public mode introduced by thelounge#370
deba6f3
xPaw added a commit that referenced this pull request Jun 19, 2016
@xPaw
Fix crash in public mode introduced by #370 (#413)
f0adee1
astorije added a commit that referenced this pull request Aug 10, 2016
@astorije
Fix token persistency across server restarts
cf64cb0 
This fixes a regression introduced by LDAP support addition
(#477), which forces
users to re-login when the server restarts. This was originally
implemented in #370.
@astorije astorije mentioned this pull request Aug 10, 2016
Merged
@astorije astorije mentioned this pull request Jul 21, 2017
Merged
matburnham pushed a commit to matburnham/lounge that referenced this pull request Sep 6, 2017
@astorije
Merge pull request thelounge#370 from thelounge/xpaw/persistent-token
a1a108e 
Implement user token persistency
matburnham pushed a commit to matburnham/lounge that referenced this pull request Sep 6, 2017
@maxpoulin64
Fix crash in public mode introduced by thelounge#370
18ba169
matburnham pushed a commit to matburnham/lounge that referenced this pull request Sep 6, 2017
@xPaw
Fix crash in public mode introduced by thelounge#370 (thelounge#413)
f17f4e9
matburnham pushed a commit to matburnham/lounge that referenced this pull request Sep 6, 2017
@astorije
Fix token persistency across server restarts
22cf600 
This fixes a regression introduced by LDAP support addition
(thelounge#477), which forces
users to re-login when the server restarts. This was originally
implemented in thelounge#370.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@astorije astorije

@maxpoulin64 maxpoulin64

Labels
Type: Feature Tickets that describe a desired feature or PRs that add them to the project. Type: Security Security concern or PRs that must be reviewed with extra care regarding security.
Projects
None yet
Milestone
2.0.0
Development

Successfully merging this pull request may close these issues.
3 participants
@xPaw @astorije @maxpoulin64