lynndylanhurley / lynndylanhurley/devise_token_auth
Unable to set user by token when there are duplicated uids
- Dominant language
- Ruby
- Stars
- 3.6k
- Forks
- 1.1k
- PR merge metrics
- No merged PRs in 30d
Description
When two users have the same uids with different providers, the `set_user_by_token` method can not set user.
For example, there are two users
| id | provider | uid |
| -- | -- | -- |
| 1 | google | 123 |
| 2 | facebook | 123 |
When we set the token of user(id=1) into request headers, because we use `rc.dta_find_by(uid: uid)` to find user, user(id=2) will be fetched, and token of user(id=2) is not matched with the tokens in headers, so `@resource = nil` will be executed.
* **Version**: https://github.com/lynndylanhurley/devise_token_auth version: 1.1.5
https://github.com/lynndylanhurley/devise_token_auth/blob/5c0baba8aaf005d03daeaf425d555739d3215603/app/controllers/devise_token_auth/concerns/set_user_by_token.rb#L78
Contributor guide
Research direction
Start in app/controllers/devise_token_auth/concerns/set_user_by_token.rb at the referenced line, then trace how dta_find_by(uid: uid) selects a user and how the request token is matched. Reproduce the case with duplicate uids and different providers, and verify that the token identifies the intended user rather than leaving @resource nil.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rails, ruby
- Domain
- api, authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100