Repository navigation
fix: namespace auth token storage key to prevent cross-instance sessi… - #1405
Conversation
|
Hi @Spiral-Memory , gentle bump on this one. All CI checks are green with 0 merge conflicts against latest develop. Please let me know if this looks good to merge or if there's anything you'd like me to update. Appreciate your guidance! ✨ |
| if (token) { | ||
| return token; | ||
| } | ||
| // Backward compatibility: fallback and migrate legacy 'ec_token' if namespaced key is empty |
There was a problem hiding this comment.
We can remove the fallback
There was a problem hiding this comment.
Removed the legacy fallback completely. getTokenLocalStorage and deleteTokenLocalStorage now strictly operate on the targeted key.
| return tokenStorageKey; | ||
| } | ||
| if (host) { | ||
| const normalizedHost = host.trim().replace(/\/+$/, ''); |
There was a problem hiding this comment.
Can we have a cleaner way of doing this?
There was a problem hiding this comment.
@Spiral-Memory - Replaced the manual regex string trimming with standard new URL(...).host parsing. It cleanly extracts the hostname/port (e.g., ec_token_localhost:3000, ec_token_open.rocket.chat), strips trailing slashes/paths automatically, and gracefully falls back to 'ec_token'.
|
@Aryan-Verma-999 You can review as well. |
…ge key resolution
|
Hi @Spiral-Memory @Aryan-Verma-999! 👋 Removed the legacy ec_token migration fallback in auth.js. All tests and Prettier checks are passing cleanly. Ready for review whenever you have a moment! 😊 |
Summary
Closes #1105
When multiple EmbeddedChat instances (e.g. Sales Bot and Support Bot, or multi-tenant widgets) co-exist on the same domain, logging into one instance previously overwrote the authentication session of the other because the
localStoragekey was hardcoded to'ec_token'inpackages/react/src/lib/auth.js.This pull request introduces host-scoped namespaced token storage keys with an opt-in
tokenStorageKeyprop override and automatic backward-compatible session migration.Key Changes
Dynamic Namespaced Storage Keys (
packages/react/src/lib/auth.js):getTokenStorage(secure, key)and local storage helpers to accept a configurable storage key.getTokenLocalStoragefalls back to and migrates any existing legacy'ec_token'session so existing users are never logged out upon upgrading.Host-Scoped Resolution & Memoization (
packages/react/src/views/EmbeddedChat.js):ec_token_${normalizedHost}, ensuring different servers maintain completely independent sessions.roomId), ensuring that switching channels within the same chat instance does not log the user out.tokenStorageKeyprop withPropTypescoverage for integrators needing custom instance isolation on the same host.getTokenStorage(secure, storageKey)inuseMemoto eliminate unnecessary function recreations and prevent redundantRCInstancere-renders.Verification
https://sales.example.com) does not overwrite Instance B (https://support.example.com).'ec_token'migrate seamlessly without user intervention.npx prettier --check).npm run build(dist/cjsanddist/esmgenerated without errors).