anitab-org / anitab-org/bridge-in-tech-backend
Bug: AUTH_COOKIE user_id persist as long as the server runs
- Lenguaje dominante
- Python
- Estrellas
- 24
- Forks
- 80
- Métricas de merge de PR
- Sin PR fusionados en 30 d
Descripción
**Describe the bug**
AUTH_COOKIE user_id from the previous logged in user persist and can be used by the next logged in user to get previous logged in user information
**To Reproduce**
Steps to reproduce the behavior:
1. Make sure you have 2 users in the database (if you don't have them, create and confirm email verifications). Here I have test0101 and test0202

2. Make sure one of your user has created an additional information and the other has none. Here I have user test0101 has an additional information

3. Logged in as test0101, get details by sending GET /user/peersonal_details which will set the AUTH_COOKIE user_id. Then view additional information, which should be returning additional information for user_id 2 (test0101 user_id)
4. Now login as test0202 and try get user additional information (which supposed to be for test0202) without sending GET /user/personal_details for user test0202. Notice that the api will responded by returning user test0101 additional information since the AUTH_COOKIE user_id still has the user test0101 user id.
5. Only when test0202 send the GET /user/personal_details this AUTH_COOKIE will change to test0202 user_id (== 3) then when you try send GET /user/additional_information request for user test0202, it will return with the proper error message : "No additional information found with your data. Please provide them now."

**Expected behavior**
Only authenticated user should be allowed/able to retrieve their own user additional_info with GET/user/additional_info request.
**Screenshots**
see gifs above
**Desktop (please complete the following information):**
- OS: MAC OS
- Browser Safari
- Version ?
**Additional context**
TO DO: upon login, previous AUTH_COOKIE user_id (if any) need to be removed.
Guía de contribución
Evaluación
Este issue todavía no se ha evaluado.