inrupt / inrupt/solid-client-authn-js
Crash when client time is wrong
Open
Nobody has claimed this yet.
bug
- Dominant language
- TypeScript
- Stars
- 77
- Forks
- 49
- Avg merge
- 18h 20m
- Merged PRs (30d)
- 32
Description
When the client has the wrong time, depending on the difference, CSS and ESS) will send an error response. See for instance https://github.com/CommunitySolidServer/CommunitySolidServer/issues/1012
solid-client-authn-js does not handle such error responses properly.
To reproduce:
- Create a pod at https://pod.playground.solidlab.be/idp/register/
- Set your computer time in the past or the future
- Try to sign on to any app using solid-client-authn-js
- The server will send
{"error":"invalid_dpop_proof","error_description":"invalid DPoP key binding"} - The client will crash
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the failure in solid-client-authn-js using the listed pod and an intentionally incorrect client clock. Start by tracing handling of the invalid_dpop_proof response; done means the sign-on attempt reports the server error without crashing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100