anitab-org / anitab-org/bridge-in-tech-backend

Bug: AUTH_COOKIE user_id persist as long as the server runs

未关闭
#94 12 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
Category: Coding Category: Outreach/Research Status: Available
主要语言
Python
星标
24
派生
80
PR 合并指标
30 天内没有已合并 PR

描述

**Describe the bug**
AUTH_COOKIE user_id from the previous logged in user persist and can be used by the next logged in user to get previous logged in user information

**To Reproduce**
Steps to reproduce the behavior:
1. Make sure you have 2 users in the database (if you don't have them, create and confirm email verifications). Here I have test0101 and test0202
![Screen Shot 2020-07-23 at 11 53 04 am](https://user-images.githubusercontent.com/29667122/88245714-8d5fee80-ccdb-11ea-93cb-d395980c0b29.png)

2. Make sure one of your user has created an additional information and the other has none. Here I have user test0101 has an additional information
![Screen Shot 2020-07-23 at 11 53 11 am](https://user-images.githubusercontent.com/29667122/88245759-ba140600-ccdb-11ea-9757-5a6fba5672e7.png)

3. Logged in as test0101, get details by sending GET /user/peersonal_details which will set the AUTH_COOKIE user_id. Then view additional information, which should be returning additional information for user_id 2 (test0101 user_id)

4. Now login as test0202 and try get user additional information (which supposed to be for test0202) without sending GET /user/personal_details for user test0202. Notice that the api will responded by returning user test0101 additional information since the AUTH_COOKIE user_id still has the user test0101 user id.

5. Only when test0202 send the GET /user/personal_details this AUTH_COOKIE will change to test0202 user_id (== 3) then when you try send GET /user/additional_information request for user test0202, it will return with the proper error message : "No additional information found with your data. Please provide them now."

![ezgif com-video-to-gif (5)](https://user-images.githubusercontent.com/29667122/88246908-4e339c80-ccdf-11ea-82d8-1523bbee7671.gif)

**Expected behavior**
Only authenticated user should be allowed/able to retrieve their own user additional_info with GET/user/additional_info request.

**Screenshots**
see gifs above

**Desktop (please complete the following information):**
- OS: MAC OS
- Browser Safari
- Version ?

**Additional context**
TO DO: upon login, previous AUTH_COOKIE user_id (if any) need to be removed.

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。