Casdoor remaining issues

[nighca]

1. Performance improvement

Consider use CDN (or Vercel deployment) for static assets (and pages), like https://acc.goplus.org/static/js/main.4b169dc0.js

2. User ID

Related document: https://casdoor.org/docs/user/overview#user-properties

3. Use non-built-in organization for goplus users

For now organization built-in is used for env production. It is better to create a new organization for goplus users.

4. Simplify integration (low priority)

Use standard oauth SDK instead of casdoor js sdk

[hsluoyz]

@nighca

1. See Casdoor CDN deployment docs: https://casdoor.org/docs/deployment/deploy-cdn
2. Casdoor indeed uses org name + user name, but user ID is also usable. There should be no duplications
3. Create new org

[nighca]

2. Casdoor indeed uses org name + user name, but user ID is also usable. There should be no duplications

@hsluoyz Thanks for reply.

I wonder why "there should be no duplications for user ID". We found that when authorized with 3rd party oauth provider, e.g., Github, Casdoor use ID from the provider directly as user ID. When there are more than one oauth provider enabled in one organization, there's a risk of ID duplication across different providers.

[hsluoyz]

@nighca that's more of a feature. E.g., you have a github account named linus, then have a facebook account named linus too. They can be the same user. While, this may not be always true. But When it's not true, the ID is usually more complicated, which is hard to duplicated. Anyway, it's just not an "realistic and obvious bug" in common sense.

[nighca]

E.g., you have a github account named linus, then have a facebook account named linus too. They can be the same user.

@hsluoyz IDs from third-party providers are often nonsensical strings or auto-incrementing numbers. For instance, my GitHub authorization ID is 1492263, not nighca. Others may also own a Facebook account with the same ID.

I am concerned about the small risk of ID duplication because we do need a reliable and unique identifier for users in our application.

According to the casdoor docs:

Id: Unique identifier for each user

This is misleading. If we rely on the Id from Casdoor as the unique user identifier, it could lead to data leaks.

[nighca]

Deployment in #933