angular / angular/angularfire

login state with signInWithCustomToken shared with browser tabs

オープン
#3,659 コメント 1 件 リアクション 0 件 担当者 0 名 GitHub で見る
主要言語
TypeScript
スター
7.8k
フォーク
2.2k
平均マージ
22時間 28分
マージ済み PR(30日)
6

説明

Hi

I have an application built with angular fire.
How can I not share login state among tabs in a same browser ?

## Application overview

I have a class 'FireService' to login with custom token.
And application let users to login two ways 'as account owner' or 'as public user'.
And if an account owner logins, FireService#login method will be called.
And if a public user logins, FireService#loginAsPublicUser method will be called.

## Issue
With same browser but different tab, login as an account owner in a tab 'A' and login as a public user in a tab 'B', the login state was overridden with the public users's and he gets an error due to insufficient permission of firebase rules. Because the owner was trying to access as the public user and blocked by my firebase rules.

I checked the browsers log, after the account owner's stats was overridden, the authorization headers value to start session with firestore was the public user's not the account ownser's.
How can I use login state separately for users different tabs in a same browser?

```
curl 'https://firestore.googleapis.com/google.firestore.v1.Firestore/Listen/channel?VER=8&database=projects%2{project name}%2Fdatabases%2F(default)&RID=*****&CVER=*****X-HTTP-Session-Id=gsessionid&zx=*****&t=1' \
~~~
-H 'x-client-data: CJ2EywE=' \
--data-raw 'headers=*****Authorization%3ABearer%20eyJhbGciOiJSU*****'
```

```
@Injectable()
export class FireService {

~~~~

public async login(roomId?: string): Promise {
if (roomId) {
this.roomId = roomId;
}
const res = await this.serverClient
.getFirebaseToken(this.roomId)
.toPromise();

this.accountId = this.serverClient.getAccountId();

try {
await this.angularFireAuth.signInWithCustomToken(res.firebaseToken);
this.startTokenRefresh(true);
this.loggedIn = true;
} catch (error) {
console.error(error);
}
}

public async loginAsPublicUser(
participantId: string,
sharedRoomId: string,
password: string
): Promise {
this.participantId = participantId;
this.sharedRoomId = sharedRoomId;
this.password = password;
const res = await this.serverClient
.getPublicFirebaseToken(
this.participantId,
this.sharedRoomId,
this.password
)
.toPromise();

try {
await this.angularFireAuth.signOut();
await this.angularFireAuth.signInWithCustomToken(res.firebaseToken);
this.startTokenRefresh(true);
this.loggedIn = true;
} catch (error) {
console.error(error);
}
}
```

コントリビューションガイド

コントリビューションガイドを開く

調査の方向性

Start with the FireService login and loginAsPublicUser methods, especially their angularFireAuth.signInWithCustomToken and signOut calls. Check the AngularFire authentication entry points and browser persistence behavior to determine whether separate tab state is supported. Done means account-owner and public-user sessions remain isolated across tabs without overriding each other's authorization state.

索引モデルが issue の本文から書いたものです。

評価

技術スタック
angular, firebase, typescript
領域
authentication
issue の種類
機能追加
難易度
5/5
見積もり時間
1週間以上
活発さ
停滞
明瞭さ
説明が足りない
初心者へのやさしさ
25/100

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。