anitab-org / anitab-org/bridge-in-tech-backend

Bug: AUTH_COOKIE user_id persist as long as the server runs

Abierto
#94 12 comentarios 0 reacciones 0 asignados Ver en GitHub
Category: Coding Category: Outreach/Research Status: Available
Lenguaje dominante
Python
Estrellas
24
Forks
80
Métricas de merge de PR
Sin PR fusionados en 30 d

Descripción

**Describe the bug**
AUTH_COOKIE user_id from the previous logged in user persist and can be used by the next logged in user to get previous logged in user information

**To Reproduce**
Steps to reproduce the behavior:
1. Make sure you have 2 users in the database (if you don't have them, create and confirm email verifications). Here I have test0101 and test0202
![Screen Shot 2020-07-23 at 11 53 04 am](https://user-images.githubusercontent.com/29667122/88245714-8d5fee80-ccdb-11ea-93cb-d395980c0b29.png)

2. Make sure one of your user has created an additional information and the other has none. Here I have user test0101 has an additional information
![Screen Shot 2020-07-23 at 11 53 11 am](https://user-images.githubusercontent.com/29667122/88245759-ba140600-ccdb-11ea-9757-5a6fba5672e7.png)

3. Logged in as test0101, get details by sending GET /user/peersonal_details which will set the AUTH_COOKIE user_id. Then view additional information, which should be returning additional information for user_id 2 (test0101 user_id)

4. Now login as test0202 and try get user additional information (which supposed to be for test0202) without sending GET /user/personal_details for user test0202. Notice that the api will responded by returning user test0101 additional information since the AUTH_COOKIE user_id still has the user test0101 user id.

5. Only when test0202 send the GET /user/personal_details this AUTH_COOKIE will change to test0202 user_id (== 3) then when you try send GET /user/additional_information request for user test0202, it will return with the proper error message : "No additional information found with your data. Please provide them now."

![ezgif com-video-to-gif (5)](https://user-images.githubusercontent.com/29667122/88246908-4e339c80-ccdf-11ea-82d8-1523bbee7671.gif)

**Expected behavior**
Only authenticated user should be allowed/able to retrieve their own user additional_info with GET/user/additional_info request.

**Screenshots**
see gifs above

**Desktop (please complete the following information):**
- OS: MAC OS
- Browser Safari
- Version ?

**Additional context**
TO DO: upon login, previous AUTH_COOKIE user_id (if any) need to be removed.

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.