Repository navigation
Conversation
A link's callback reads the user from catapult-api's in-memory session, lost on every restart while catapult-web still shows the user logged in. catapult-web now relays the user's JWT when a link starts, and catapult-api restores its session from it, replacing a stale session of another user.
An admin acting as a member must not link their own Steam, Xbox or Battle.net account to the member's: catapult-web sends no JWT then, and catapult-api refuses impersonation tokens. The filter also resolves its beans on use, so web test slices that pick it up still load.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
In prod, linking Battle.net right after the 1.3.1 deploy failed with
BATTLENET link attempted without an authenticated Twitch session. A secondary link's callback (Steam, Xbox, Battle.net) reads the user from catapult-api's own HTTP session (CATAPULT_API_SESSION), which lives in memory: every catapult-api restart loses it, while catapult-web still shows the user logged in. Until the user logs in with Twitch again, every link fails.Fix
ApiRelayController): when relaying/oauth2/authorization/<provider>(excepttwitch), it sends the session's JWT asAuthorization: Bearer, replacing any header the visitor sent.LinkSessionRestoreFilter, before Spring Security): on those paths, a valid token is checked with the sameJwtDecoderas/api/**(signature, expiry, fictitious accounts). If it names an active account, that account is put in the session, so the callback finds it as before.ROLE_PREVIOUS_ADMINISTRATOR. An admin's own provider account is never linked to the member's.JwtDecoderandUserAccountRepositoryon use: as a servlet filter it is picked up by every@WebMvcTestslice, which has neither bean.Checks
LinkSessionRestoreFilterTest(6), plus 3 new cases inApiRelayControllerTest. The full catapult-api and catapult-web suites pass locally.bootRunof catapult-api starts with the new filter.Modules to restart: catapult-api and catapult-web, deployed together. Either one alone changes nothing; neither breaks the other.