You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
After several times of logout spatacus use method revokeTokenAndLogout() from OAuthService and it doing revoke of 2 tokens refresh and access, it's mean it doing 2 api calls all the time. It happens that access token are revoked faster that refreshToken and when makes api call it use auth Bearer auth token and accessToken not valid as it was revoked already.
Pls check attached screenshots.
Impactas
When one of api call for revoking tokens return 401, it doesn't revoke token. It's huge security risk of potential unauthorised access on behalf of the customer.
Tell us the version of Spartacus
v6.0.0
angular-oauth2-oidc
v15.0.1
To Reproduce
Steps to reproduce the behavior:
Login
Logout
Doing 2 prev steps few times
Check 2 api calls baseURL/authorizationserver/oauth/revoke. One of then return 401.
Expected behavior
Should revoke refreshToken first and after accessToken
Screenshots
If applicable, add screenshots to help explain your problem.
The text was updated successfully, but these errors were encountered:
Details
After several times of logout spatacus use method
revokeTokenAndLogout()
fromOAuthService
and it doing revoke of 2 tokens refresh and access, it's mean it doing 2 api calls all the time. It happens that access token are revoked faster that refreshToken and when makes api call it use authBearer auth token
and accessToken not valid as it was revoked already.Pls check attached screenshots.
Impactas
When one of api call for revoking tokens return 401, it doesn't revoke token. It's huge security risk of potential unauthorised access on behalf of the customer.
Tell us the version of Spartacus
angular-oauth2-oidc
To Reproduce
Steps to reproduce the behavior:
baseURL/authorizationserver/oauth/revoke
. One of then return 401.Expected behavior
Should revoke refreshToken first and after accessToken
Screenshots
If applicable, add screenshots to help explain your problem.
The text was updated successfully, but these errors were encountered: