RocketChat / RocketChat/Rocket.Chat
Mobile push notifications are sent after auth token is invalidated
Open
Nobody has claimed this yet.
feat: notification
type: bug
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
Steps to reproduce:
- Login user via iFrame authentication on mobile app (postMessage API).
- Invalidate auth token via REST API (either logout or users.removeOtherTokens call).
- User will actually get logged out - this part works.
Expected behavior:
User shouldn't receive any push notifications after auth token is invalidated and you are logged out of the server.
Actual behavior:
At least sporadically, push notifications still get sent to the app after the user is logged out.
Server Setup Information:
- Version of Rocket.Chat Server: 3.5.0-develop
- Operating System: Ubuntu 18.04
- Deployment Method: docker
- Number of Running Instances: 1
Client Setup Information
- App Version: 4.9.0.308
- Operating System: iOS
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the postMessage authentication flow and the REST users.removeOtherTokens/logout handling, then follow how push notifications are delivered after token invalidation. Reproduce with the stated Rocket.Chat 3.5.0-develop server and iOS 4.9.0.308 app; done means no push reaches the app after logout or token invalidation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ios, typescript
- Domain
- authentication, mobile
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100