Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cookies not behaving correctly for OIDC users when using "Option 2" #12

Open
fservida opened this issue May 1, 2022 · 3 comments
Open

Comments

@fservida
Copy link

fservida commented May 1, 2022

When logging users directly using "Option 2" it seems that the cookies are not checked and authentication is performed for every request to the OIDC provider.

Don't know if this is the expected behaviour, but it does create problems with for example XHR requests.
I think this is due to https://github.com/YOURLS/YOURLS/blob/a2d0d2f626c7ee8fcd280eb91d08c61354578d04/includes/functions-auth.php#L324-L333 not checking cookies is the user is not in the local database.

@fservida
Copy link
Author

fservida commented May 1, 2022

Note for me
As the cookie is encrypted, the user is not available unless we poll the OIDC provider (and thus have the same problem).
One solution might be to store the users logged in through oidc in the options table and fetch that list to iterate over just as yourls does with the $yourls_user_passwords array.

@fservida
Copy link
Author

fservida commented May 1, 2022

Alternatively store the username in a cookie too

@fservida
Copy link
Author

fservida commented May 1, 2022

Implemented in #11
To be closed on merge :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant