guardian / guardian/dotcom-rendering
Remove option to retrieve user identity from cookie
- Dominant language
- TypeScript
- Stars
- 274
- Forks
- 34
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 121
Description
There is a switch in Frontend that controls whether we use Okta as the source of truth for a logged in user, or whether we use cookies.
Identity & Trust are removing the ability to authenticate the `/me` endpoints using cookies. Okta will be the only means of authenticating, and hitting their services should be the only way of accessing user data.
This means we should remove the mechanism by which we were able to extract user data from the `GU_U` user cookie.
For example, we could remove:
- the [interesting](https://github.com/guardian/dotcom-rendering/blob/9cd5a5017cc9119e8c1427b850bfe79c31c7f1f6/dotcom-rendering/src/lib/identity.ts#L139-L151) [branching](https://github.com/guardian/dotcom-rendering/blob/94387a9695b1593101b5afba23e85aa7cc03d2a5/dotcom-rendering/src/lib/identity.ts#L184-L193) in the identity module and [useAuthStatus](https://github.com/guardian/dotcom-rendering/blob/94387a9695b1593101b5afba23e85aa7cc03d2a5/dotcom-rendering/src/lib/useAuthStatus.ts) in DCR (that is somewhat duplicated in [commercial](https://github.com/guardian/commercial/blob/7803bb8b77509d84c067aac5d0f609e2d35e3dd5/src/lib/identity/api.ts#L196-L204))
- the [cookie fallback logic](https://github.com/guardian/csnx/blob/568cfc088d0e980e40840b0cac9b0ca37f12f309/libs/%40guardian/identity-auth/src/identityAuth.ts#L130-L149) in identity-auth in CSNX
- the [Okta switch](https://github.com/guardian/frontend/blob/main/common/app/conf/switches/IdentitySwitches.scala#L18-L27) in frontend
Not all of this will be on the menu for WebX and we should agree with I&T, as well as other teams, how much we can take on.
Some [pressed pages](https://github.com/guardian/frontend/blob/main/common/app/services/dotcomrendering/PressedContent.scala) ([example](https://www.theguardian.com/world/ng-interactive/2017/mar/01/who-are-europes-newcomers)) and [pressed interactives](https://github.com/guardian/frontend/blob/main/common/app/services/dotcomrendering/InteractiveLibrarian.scala) use older DCR or frontend JavaScript bundles that still rely on cookies. On these pages, the JavaScript would no longer be able to verify that the user is logged in (they were pressed before our integration with Okta was established), and there may be some impact on the user experience as a result. For example, it's likely that these pages would not show the "My account" dropdown menu. I expect that we would instead show a "Sign in" link, but we'd need to verify this.
See also: [Okta, IDAPI cookies and pressed pages](https://docs.google.com/document/d/1ucGAL4_Fz-y6GzgdrR_th0mOCEau_W1i0DJ60Lvh1Bo/edit)
Contributor guide
Assessment
This issue has not been assessed yet.