Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use history replaceState instead of redirect for SSO flow #16292

Merged
merged 1 commit into from
Jan 29, 2021
Merged

Use history replaceState instead of redirect for SSO flow #16292

merged 1 commit into from
Jan 29, 2021

Conversation

t3chguy
Copy link
Member

@t3chguy t3chguy commented Jan 27, 2021

Has additional benefit of not leaving the loginToken in history

@t3chguy
Improve SSO auth flow
d47948f 
Use replaceState instead of a redirect to strip the loginToken
Put user into the same post-auth flows of E2ESetup
Skip UIA prompt in this post-auth flow, happy path is a server grace period
@t3chguy t3chguy mentioned this pull request Jan 27, 2021
Merged
@t3chguy t3chguy requested a review from a team January 27, 2021 12:54
jryans
jryans approved these changes Jan 27, 2021
View reviewed changes
Copy link
Collaborator

@jryans jryans left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, this seems sensible to me. It does mean the original query params may still be in bits of app state if they were captured on load, but it doesn't seem like that will cause problems or security risks as far as I can see.

@t3chguy
Copy link
Member Author

t3chguy commented Jan 27, 2021

The token is single use, purging it from history & url is just a cleanliness thing

@t3chguy t3chguy merged commit d5a824d into develop Jan 29, 2021
@t3chguy t3chguy deleted the t3chguy/sso_fixes branch January 29, 2021 13:29
@bekliev
Copy link
Contributor

bekliev commented Feb 9, 2021 •
edited
Loading

@t3chguy if another params are passed alongside loginToken - will they remain in window.location API after redirect/replaceState?

bekliev
bekliev reviewed Feb 9, 2021
View reviewed changes
src/vector/app.tsx
@@ -124,7 +124,7 @@ function onTokenLoginCompleted() {
parsedUrl.search = "";
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe it's better to just clean particular query param?
In our case it's the loginToken

bekliev added a commit to bekliev/element-web that referenced this pull request Feb 9, 2021
@bekliev
fix / sso: after complete login via token make sure to delete only lo…
21b4047 
…ginToken query-param from the window.location api.

Related to element-hq#16292

Signed-off-by: Bekliev Parviz <nightkon95@gmail.com>
@bekliev bekliev mentioned this pull request Feb 9, 2021
Merged
@t3chguy
Copy link
Member Author

t3chguy commented Feb 9, 2021

@bekliev maybe, I was just matching the behaviour that was already there and swapping the redirect for a replaceState

bekliev added a commit to bekliev/element-web that referenced this pull request Feb 9, 2021
@bekliev
fix / sso: after complete login via token make sure to delete only lo…
3e57378 
…ginToken query-param from the window.location api.

Related to element-hq#16292

Signed-off-by: Bekliev Parviz <nightkon95@gmail.com>
bekliev added a commit to bekliev/element-web that referenced this pull request Feb 11, 2021
@bekliev
fix / sso: switched from Node's url API to browser's URL.
ff7412d 
Related to element-hq#16292

Signed-off-by: Bekliev Parviz <nightkon95@gmail.com>
bekliev added a commit to bekliev/element-web that referenced this pull request Feb 11, 2021
@bekliev
Migrating from Node's deprecated url API to browser's URL
40fb2f3 
Related to element-hq#16292

Signed-off-by: Bekliev Parviz <nightkon95@gmail.com>
bekliev added a commit to bekliev/element-web that referenced this pull request Feb 11, 2021
@bekliev
Migrating from Node's deprecated url API to browser's URL
dd46386 
Related to element-hq#16292

Signed-off-by: Bekliev Parviz <nightkon95@gmail.com>
bekliev added a commit to bekliev/element-web that referenced this pull request Feb 11, 2021
@bekliev
Migrating from Node's deprecated url API to browser's URL
c483a8c 
Related to element-hq#16292

Signed-off-by: Bekliev Parviz <nightkon95@gmail.com>
bekliev added a commit to bekliev/element-web that referenced this pull request Feb 11, 2021
@bekliev
Migrating from Node's deprecated url API to browser's URL
92a5787 
Related to element-hq#16292

Signed-off-by: Bekliev Parviz <nightkon95@gmail.com>
netbsd-srcmastr pushed a commit to NetBSD/pkgsrc that referenced this pull request Mar 6, 2021
@Midar
Update chat/element-web to 1.7.22
7c867f4 
Changes in [1.7.22](https://github.com/vector-im/element-web/releases/tag/v1.7.22) (2021-03-01)
===============================================================================================
[Full Changelog](element-hq/element-web@v1.7.22-rc.1...v1.7.22)

## Security notice

Element Web 1.7.22 fixes (by upgrading to matrix-react-sdk 3.15.0) a low
severity issue (CVE-2021-21320) where the user content sandbox can be abused to
trick users into opening unexpected documents. The content is opened with a
`blob` origin that cannot access Matrix user data, so messages and secrets are
not at risk.  Thanks to @keerok for responsibly disclosing this via Matrix's
Security Disclosure Policy.

## All changes

 * Upgrade to React SDK 3.15.0 and JS SDK 9.8.0

Changes in [1.7.22-rc.1](https://github.com/vector-im/element-web/releases/tag/v1.7.22-rc.1) (2021-02-24)
=========================================================================================================
[Full Changelog](element-hq/element-web@v1.7.21...v1.7.22-rc.1)

 * Upgrade to React SDK 3.15.0-rc.1 and JS SDK 9.8.0-rc.1
 * Translations update from Weblate
   [\#16529](element-hq/element-web#16529)
 * Add hostSignup config for element.io clients
   [\#16515](element-hq/element-web#16515)
 * VoIP virtual rooms, mkII
   [\#16442](element-hq/element-web#16442)
 * Jitsi widget: Read room name from query parameters
   [\#16456](element-hq/element-web#16456)
 * fix / sso: make sure to delete only loginToken after redirect
   [\#16415](element-hq/element-web#16415)
 * Disable Countly
   [\#16433](element-hq/element-web#16433)

Changes in [1.7.21](https://github.com/vector-im/element-web/releases/tag/v1.7.21) (2021-02-16)
===============================================================================================
[Full Changelog](element-hq/element-web@v1.7.21-rc.1...v1.7.21)

 * Upgrade to React SDK 3.14.0 and JS SDK 9.7.0

Changes in [1.7.21-rc.1](https://github.com/vector-im/element-web/releases/tag/v1.7.21-rc.1) (2021-02-10)
=========================================================================================================
[Full Changelog](element-hq/element-web@v1.7.20...v1.7.21-rc.1)

 * Upgrade to React SDK 3.14.0-rc.1 and JS SDK 9.7.0-rc.1
 * Translations update from Weblate
   [\#16427](element-hq/element-web#16427)
 * Add RegExp dotAll feature test
   [\#16408](element-hq/element-web#16408)
 * Fix Electron type merging
   [\#16405](element-hq/element-web#16405)
 * README: remove Jenkins reference
   [\#16381](element-hq/element-web#16381)
 * Enable PostCSS Calc in webpack builds
   [\#16307](element-hq/element-web#16307)
 * Add configuration security best practices to the README.
   [\#16367](element-hq/element-web#16367)
 * Upgrade matrix-widget-api
   [\#16347](element-hq/element-web#16347)

Changes in [1.7.20](https://github.com/vector-im/element-web/releases/tag/v1.7.20) (2021-02-04)
===============================================================================================
[Full Changelog](element-hq/element-web@v1.7.19...v1.7.20)

 * Upgrade to React SDK 3.13.1

Changes in [1.7.19](https://github.com/vector-im/element-web/releases/tag/v1.7.19) (2021-02-03)
===============================================================================================
[Full Changelog](element-hq/element-web@v1.7.19-rc.1...v1.7.19)

 * Upgrade to React SDK 3.13.0 and JS SDK 9.6.0
 * [Release] Upgrade matrix-widget-api
   [\#16348](element-hq/element-web#16348)

Changes in [1.7.19-rc.1](https://github.com/vector-im/element-web/releases/tag/v1.7.19-rc.1) (2021-01-29)
=========================================================================================================
[Full Changelog](element-hq/element-web@v1.7.18...v1.7.19-rc.1)

 * Upgrade to React SDK 3.13.0-rc.1 and JS SDK 9.6.0-rc.1
 * Translations update from Weblate
   [\#16314](element-hq/element-web#16314)
 * Use history replaceState instead of redirect for SSO flow
   [\#16292](element-hq/element-web#16292)
 * Document the mobile guide toast option
   [\#16301](element-hq/element-web#16301)
 * Update widget-api to beta.12
   [\#16303](element-hq/element-web#16303)
 * Upgrade deps 2021-01
   [\#16294](element-hq/element-web#16294)
 * Move to newer base image for Docker builds
   [\#16275](element-hq/element-web#16275)
 * Docs for the VoIP translate pattern option
   [\#16236](element-hq/element-web#16236)
 * Fix Riot->Element in permalinkPrefix docs
   [\#16227](element-hq/element-web#16227)
 * Supply server_name for optional federation-capable Jitsi auth
   [\#16215](element-hq/element-web#16215)
 * Fix Widget API version confusion
   [\#16212](element-hq/element-web#16212)
 * Add Hebrew language
   [\#16210](element-hq/element-web#16210)
 * Update widget-api to beta 11
   [\#16177](element-hq/element-web#16177)
 * Fix develop Docker builds
   [\#16192](element-hq/element-web#16192)
 * Skip the service worker for Electron
   [\#16157](element-hq/element-web#16157)
 * Use isolated IPC API
   [\#16137](element-hq/element-web#16137)

Changes in [1.7.18](https://github.com/vector-im/element-web/releases/tag/v1.7.18) (2021-01-26)
===============================================================================================
[Full Changelog](element-hq/element-web@v1.7.17...v1.7.18)

 * Upgrade to React SDK 3.12.1 and JS SDK 9.5.1

Changes in [1.7.17](https://github.com/vector-im/element-web/releases/tag/v1.7.17) (2021-01-18)
===============================================================================================
[Full Changelog](element-hq/element-web@v1.7.17-rc.1...v1.7.17)

 * Upgrade to React SDK 3.12.0 and JS SDK 9.5.0

Changes in [1.7.17-rc.1](https://github.com/vector-im/element-web/releases/tag/v1.7.17-rc.1) (2021-01-13)
=========================================================================================================
[Full Changelog](element-hq/element-web@v1.7.16...v1.7.17-rc.1)

 * Upgrade to React SDK 3.12.0-rc.1 and JS SDK 9.5.0-rc.1
 * Translations update from Weblate
   [\#16131](element-hq/element-web#16131)
 * webplatform: Fix notification closing
   [\#16028](element-hq/element-web#16028)
 * Stop building code and types for Element layer
   [\#15999](element-hq/element-web#15999)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@bekliev bekliev bekliev left review comments

@jryans jryans jryans approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@t3chguy @bekliev @jryans