persisting tokens in the session #11
Conversation
WalkthroughThe recent changes enhance authentication and session management in the Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant Frontend
participant Router
participant PageController
participant CheckAuth
User->>Frontend: Requests access to a protected route
Frontend->>Router: Sends request
Router->>CheckAuth: Checks authentication
CheckAuth->>Session: Retrieves access_token and refresh_token
alt Tokens present
CheckAuth->>Router: Proceed with request
Router->>PageController: Handle request
else Tokens missing
CheckAuth->>Frontend: Redirect to login page
end
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (invoked as PR comments)
Additionally, you can add CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Outside diff range, codebase verification and nitpick comments (2)
lib/demo_elixir_phoenix_web/router.ex (2)
Line range hint
22-37: Review route organization for clarity and maintainability.The changes organize routes into authenticated and non-authenticated scopes, which enhances clarity. Ensure that all routes are correctly categorized and that no routes requiring authentication are accidentally placed in the non-authenticated scope.
Consider documenting the purpose of each scope for future maintainability.
13-15: Add tests forCheckAuthplug to handle edge casesThe
CheckAuthplug checks for tokens in the session and redirects unauthenticated users. However, it does not explicitly handle edge cases like expired tokens or network issues during SDK initialization. Additionally, there are no automated tests found for this plug. Consider adding tests to verify its behavior under various scenarios.
- File:
lib/demo_elixir_phoenix_web/plugs/check_auth.exAnalysis chain
Ensure
CheckAuthplug is reliable and efficient.The
:authenticatedpipeline uses theCheckAuthplug to enforce authentication. Ensure that the plug efficiently handles all edge cases, such as expired tokens or network issues during SDK initialization.Consider adding tests to verify that the
CheckAuthplug correctly redirects unauthenticated requests and allows authenticated ones.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify that the `CheckAuth` plug correctly handles authentication. # Test: Ensure that the plug is redirecting unauthenticated requests. rg --type elixir -A 5 'plug DemoElixirPhoenixWeb.Plugs.CheckAuth'Length of output: 402
Script:
#!/bin/bash # Locate the implementation of the CheckAuth plug. fd 'CheckAuth.ex' # Search for test files that might verify the behavior of the CheckAuth plug. fd 'check_auth_test.exs' # If the file is found, extract the implementation of the CheckAuth plug. ast-grep --lang elixir --pattern 'defmodule DemoElixirPhoenixWeb.Plugs.CheckAuth do $$$ end'Length of output: 1648
Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (3)
- lib/demo_elixir_phoenix_web/controllers/page_controller.ex (2 hunks)
- lib/demo_elixir_phoenix_web/plugs/check_auth.ex (1 hunks)
- lib/demo_elixir_phoenix_web/router.ex (2 hunks)
Additional comments not posted (2)
lib/demo_elixir_phoenix_web/controllers/page_controller.ex (2)
31-32: Ensure secure handling of session tokens.The
callbackfunction storesaccess_tokenandrefresh_tokenin the session. Ensure these tokens are securely handled to prevent session hijacking or token leakage.Consider setting appropriate session options, such as
secureandhttp_only, to enhance security.
80-81: Ensure tokens are fully cleared on logout.The
log_outfunction deletesaccess_tokenandrefresh_tokenfrom the session. Verify that the session is fully cleared to prevent unauthorized access.Consider adding tests to ensure that logging out effectively invalidates the session.
| defmodule DemoElixirPhoenixWeb.Plugs.CheckAuth do | ||
| import Plug.Conn | ||
| alias KindeClientSDK | ||
|
|
||
| def init(default), do: default | ||
|
|
||
| def call(conn, _opts) do | ||
| access_token = get_session(conn, :access_token) | ||
| refresh_token = get_session(conn, :refresh_token) | ||
|
|
||
| if access_token && refresh_token do | ||
| conn = KindeClientSDK.init_with_tokens(conn, access_token, refresh_token) | ||
| conn | ||
| else | ||
| conn | ||
| |> Phoenix.Controller.redirect(to: "/log-in") | ||
| |> halt() | ||
| end | ||
| end | ||
| end |
There was a problem hiding this comment.
Ensure proper error handling and logging.
The CheckAuth module effectively manages authentication by checking for tokens in the session. However, it lacks error handling and logging, which are crucial for debugging and monitoring.
Consider adding logging to track when tokens are missing and when a user is redirected. Additionally, handle potential errors from KindeClientSDK.init_with_tokens/3 to ensure robustness.
def call(conn, _opts) do
access_token = get_session(conn, :access_token)
refresh_token = get_session(conn, :refresh_token)
if access_token && refresh_token do
case KindeClientSDK.init_with_tokens(conn, access_token, refresh_token) do
{:ok, conn} -> conn
{:error, reason} ->
Logger.error("Failed to initialize SDK: #{reason}")
redirect_to_login(conn)
end
else
Logger.warn("Missing tokens, redirecting to login")
redirect_to_login(conn)
end
end
defp redirect_to_login(conn) do
conn
|> Phoenix.Controller.redirect(to: "/log-in")
|> halt()
end
|
@Hammadkhan0034 so I'm trying this PR, but I'm not sure I get it working correctly. When I login (successfully) I get all the user details, but as soon as I click on permissions or user details or refresh, the user is always nil. Am I doing something wrong? |
@tcoopman as per Andre message |
|
I'll try again and I'll set-up a reproduction repository if I don't get it to work. Thanks |
|
I am not able to get refresh token after login with client credentials grant type. Can anyone let me how can I get it and what I am doing wrong. |
Explain your changes
Summary by CodeRabbit
New Features
Bug Fixes
Documentation