Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Do not allow using withAuthUserSSR when cookies are unsigned #195

Closed
Tracked by #265
kmjennison opened this issue Jun 3, 2021 · 1 comment
Closed
Tracked by #265

Do not allow using withAuthUserSSR when cookies are unsigned #195

kmjennison opened this issue Jun 3, 2021 · 1 comment
Labels
breaking The issue or PR will introduce a breaking change enhancement New feature or request help wanted Extra attention is needed

Comments

@kmjennison
Copy link
Contributor

Is your feature request related to a problem? Please describe.
Currently, it's possible for a developer to introduce a security risk by using withAuthUserSSR alongside unsigned cookies, as described in the docs:

⚠️ Do not use this when cookies.signed is set to false. Doing so is a potential security risk, because the authed user cookie values could be modified by the client.

Describe the solution you'd like and how you'd implement it
If the config cookies.signed property is false, throw if the user tries using withAuthUserSSR.

Is this a breaking change?
Yes

Describe alternatives you've considered
We could drop withAuthUserSSR altogether if developers don't need it.
@kmjennison kmjennison added enhancement New feature or request breaking The issue or PR will introduce a breaking change help wanted Extra attention is needed labels Jun 3, 2021
@kmjennison kmjennison mentioned this issue Jun 3, 2021
Closed
@kmjennison kmjennison mentioned this issue Aug 7, 2021
Closed
24 tasks
@kmjennison kmjennison mentioned this issue Dec 19, 2021
Merged
@kmjennison
Copy link
Contributor Author

Closed in #391.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
breaking The issue or PR will introduce a breaking change enhancement New feature or request help wanted Extra attention is needed
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@kmjennison