guardian / guardian/dotcom-rendering

Remove option to retrieve user identity from cookie

Open
#13,020 0 comments 0 reactions 0 assignees View on GitHub
Team Candidate: WebX
Dominant language
TypeScript
Stars
274
Forks
34
Avg merge
2d 22h
Merged PRs (30d)
121

Description

There is a switch in Frontend that controls whether we use Okta as the source of truth for a logged in user, or whether we use cookies.

Identity & Trust are removing the ability to authenticate the `/me` endpoints using cookies. Okta will be the only means of authenticating, and hitting their services should be the only way of accessing user data.

This means we should remove the mechanism by which we were able to extract user data from the `GU_U` user cookie.

For example, we could remove:
- the [interesting](https://github.com/guardian/dotcom-rendering/blob/9cd5a5017cc9119e8c1427b850bfe79c31c7f1f6/dotcom-rendering/src/lib/identity.ts#L139-L151) [branching](https://github.com/guardian/dotcom-rendering/blob/94387a9695b1593101b5afba23e85aa7cc03d2a5/dotcom-rendering/src/lib/identity.ts#L184-L193) in the identity module and [useAuthStatus](https://github.com/guardian/dotcom-rendering/blob/94387a9695b1593101b5afba23e85aa7cc03d2a5/dotcom-rendering/src/lib/useAuthStatus.ts) in DCR (that is somewhat duplicated in [commercial](https://github.com/guardian/commercial/blob/7803bb8b77509d84c067aac5d0f609e2d35e3dd5/src/lib/identity/api.ts#L196-L204))
- the [cookie fallback logic](https://github.com/guardian/csnx/blob/568cfc088d0e980e40840b0cac9b0ca37f12f309/libs/%40guardian/identity-auth/src/identityAuth.ts#L130-L149) in identity-auth in CSNX
- the [Okta switch](https://github.com/guardian/frontend/blob/main/common/app/conf/switches/IdentitySwitches.scala#L18-L27) in frontend

Not all of this will be on the menu for WebX and we should agree with I&T, as well as other teams, how much we can take on.

Some [pressed pages](https://github.com/guardian/frontend/blob/main/common/app/services/dotcomrendering/PressedContent.scala) ([example](https://www.theguardian.com/world/ng-interactive/2017/mar/01/who-are-europes-newcomers)) and [pressed interactives](https://github.com/guardian/frontend/blob/main/common/app/services/dotcomrendering/InteractiveLibrarian.scala) use older DCR or frontend JavaScript bundles that still rely on cookies. On these pages, the JavaScript would no longer be able to verify that the user is logged in (they were pressed before our integration with Okta was established), and there may be some impact on the user experience as a result. For example, it's likely that these pages would not show the "My account" dropdown menu. I expect that we would instead show a "Sign in" link, but we'd need to verify this.

See also: [Okta, IDAPI cookies and pressed pages](https://docs.google.com/document/d/1ucGAL4_Fz-y6GzgdrR_th0mOCEau_W1i0DJ60Lvh1Bo/edit)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.