auth-js icon indicating copy to clipboard operation
auth-js copied to clipboard

don't use session.user object in _getAuthenticatorAssuranceLevel()

Open kizivat opened this issue 1 year ago • 3 comments

One avoidable source of the getUser() warnings

What kind of change does this PR introduce?

Bug fix

What is the current behavior?

Can't get rid of getUser() warning

What is the new behavior?

The warning is no longer logged on the line defining verifiedFactors

Additional context

N/A

kizivat avatar May 14 '24 00:05 kizivat

The force push was to adhere to conventional commits.

kizivat avatar May 14 '24 00:05 kizivat

If the solution for this issue is making an additional getUser check inside the method – which I'm assuming should make the method trustable on the server(?) – should this call be made at the beginning of the getAuthenticatorAssuranceLevel() method (ie. before we do checks on the session)?

Otherwise, we might end up using less secure information from _useSession since this has the possibility to return early before it reaches the _getUser call.

Also to consider: what is the added performance overhead for this function by making an additional user call? Do we need to provide an option for a jwt to be passed as an argument to getAuthenticatorAssuranceLevel() since getUser can optionally take a jwt?

sleepdotexe avatar May 15 '24 00:05 sleepdotexe

You may know this, but making sure: keep in mind this change adds a network call to Supabase.

j4w8n avatar May 15 '24 02:05 j4w8n

Hi @kizivat ! Thanks for the contribution and your patience.

This repository is deprecated and has moved to the new Supabase JS monorepo. Since this PR has been inactive for over a year, I’m going to close it to keep the old repo tidy, before archiving.

If you believe this change is still needed, please open a new PR in the monorepo and include a link back to this thread for context:

  • Monorepo: https://github.com/supabase/supabase-js
  • Package location: packages/core//
  • Migration guide: https://github.com/supabase/supabase-js/blob/master/docs/MIGRATION.md
  • Contributing guide: https://github.com/supabase/supabase-js/blob/master/CONTRIBUTING.md

Note: This old repository will be archived on October 10, 2025. Thank you again for your effort and understanding!

mandarini avatar Oct 07 '25 11:10 mandarini