lynndylanhurley / lynndylanhurley/devise_token_auth

Unable to set user by token when there are duplicated uids

Open
#1,484 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
Ruby
Stars
3.6k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

When two users have the same uids with different providers, the `set_user_by_token` method can not set user.
For example, there are two users

| id | provider | uid |
| -- | -- | -- |
| 1 | google | 123 |
| 2 | facebook | 123 |

When we set the token of user(id=1) into request headers, because we use `rc.dta_find_by(uid: uid)` to find user, user(id=2) will be fetched, and token of user(id=2) is not matched with the tokens in headers, so `@resource = nil` will be executed.

* **Version**: https://github.com/lynndylanhurley/devise_token_auth version: 1.1.5
https://github.com/lynndylanhurley/devise_token_auth/blob/5c0baba8aaf005d03daeaf425d555739d3215603/app/controllers/devise_token_auth/concerns/set_user_by_token.rb#L78

Contributor guide

Open the contributing guide

Research direction

Start in app/controllers/devise_token_auth/concerns/set_user_by_token.rb at the referenced line, then trace how dta_find_by(uid: uid) selects a user and how the request token is matched. Reproduce the case with duplicate uids and different providers, and verify that the token identifies the intended user rather than leaving @resource nil.

Written by the indexing model from the issue text.

Assessment

Tech stack
rails, ruby
Domain
api, authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.