Cannot visit more than one shared link #1806

New Issue

andreymal · 2021-07-09T16:26:07Z

andreymal commented

2021-07-09 16:26:07 +00:00

Steps to reproduce:

Get two different shared links on same Vikunja instance
Visit first link
Then visit second link

Instead of opening, the fronend hangs on "Authenticating…" and does nothing because of this return (state.auth contains information about the previous shared link).

(A quick fix would be automatic logout when opening different shared link, but I guess this has deeper roots because shared links reuse the same authentication mechanism as regular users. As a consequence, if a registered user visits a shared link, the user is automatically logged out because jwt is being replaced by the shared link — this is a bad UX. I suspect that the authentication mechanism needs to be reworked, but I have no idea how to do it best, so I just leave this note here.)

Steps to reproduce: 1. Get two different shared links on same Vikunja instance 2. Visit first link 3. Then visit second link Instead of opening, the fronend hangs on "Authenticating…" and does nothing because of [this return](https://kolaente.dev/vikunja/frontend/src/commit/f0498fd767a9df1c1f89e21b2a2606377f455a0d/src/views/sharing/LinkSharingAuth.vue#L64-L65) (state.auth contains information about the previous shared link). (A quick fix would be automatic logout when opening different shared link, but I guess this has deeper roots because shared links reuse the same authentication mechanism as regular users. As a consequence, if a registered user visits a shared link, the user is automatically logged out because jwt is being replaced by the shared link — this is a bad UX. I suspect that the authentication mechanism needs to be reworked, but I have no idea how to do it best, so I just leave this note here.)

konrad commented

2021-07-09 17:03:46 +00:00

Ideally you would be able to visit multiple links simultaniously without them overriding each other. As you pointed out, that's not that easy to fix because all api connections assume an authentication token stored in local storage which is shared per domain and not per tab. To fix this, it would need to only store the auth token in memory, but only for link shares and then pass it along. Would require quite some refactoring of the way the api connection is currently implemented.

konrad added the

kind/bug

kind/feature

labels 2021-07-09 17:04:00 +00:00

konrad referenced this issue from a commit

2021-07-09 18:11:00 +00:00

Save auth tokens from link shares only in memory, don't persist them to localStorage

konrad closed this issue

2021-07-09 18:11:00 +00:00

konrad commented

2021-07-09 18:12:34 +00:00

Turns out, this is a lot less hard than I thought.

I've implemented a change in a787f6ffc7 which saves auth tokens from link shares in memory only, enabling to view multiple link shares in the same browser without them interfering each other (or a logged in user in the same browser).
I'm closing this issue as it is resolved, feel free to reopen if you have any other problems with it.

Turns out, this is a lot less hard than I thought. I've implemented a change in a787f6ffc79d6234f58868b3815c33b73d7d9952 which saves auth tokens from link shares in memory only, enabling to view multiple link shares in the same browser without them interfering each other (or a logged in user in the same browser). I'm closing this issue as it is resolved, feel free to reopen if you have any other problems with it.

andreymal commented

2021-07-09 19:34:34 +00:00

@konrad it seems I caught a race: the user/token and shares/.../auth requests are sent at almost same time, and the authorization result depends on which response comes last

@konrad it seems I caught a race: the `user/token` and `shares/.../auth` requests are sent at almost same time, and the authorization result depends on which response comes last

konrad referenced this issue from a commit

2021-07-10 10:32:15 +00:00

Add timeout to fix race condition when authenticating as a link share and renewing the token simultaneously

konrad commented

2021-07-10 10:32:36 +00:00

I've added a timout for renewing the token in 20fd25e280 which should fix that.

I've added a timout for renewing the token in 20fd25e2809b332680270faccd4bd15ef95a2145 which should fix that.

andreymal commented

2021-07-10 10:46:30 +00:00

Now it works 👍
Seems the logout button is no longer needed? Removing it will make shared pages look a bit nicer

Now it works 👍 Seems the logout button is no longer needed? Removing it will make shared pages look a bit nicer

konrad commented