Skip to content

[ENHANCEMENT]: Rework AuthService #1903

@cv5ch

Description

@cv5ch

Description

The AuthService should be reworked as it's very messy and most likely contains not yet found bugs.

  1. The main problem I see is storing the authenticated state in too many places which could easily get out of sync somewhere and lead to awkward bugs:
  • user: BehaviorSubject<AuthData | null>

  • _authUser$: BehaviorSubject<AuthUser | null>

  • isAuthenticated: boolean

  • logged: ReplaySubject

  • userLoggedIn: Subject

  1. Another problem may be using an EventEmitter in a service as it's intended for Components (see https://angular.dev/api/core/EventEmitter):
  • authChanged: EventEmitter
  1. JWT decoding: Buffer should be replaced with a browser-safe base64 decoder that properly handles URL-safe base64 padding.

  2. Login Function:

  • Credentials are sent both in header and body which is redundant and increases the exposure surface -> Decide for one method depending on what the server requires (I think the body variant)

  • Username and password are base64 encoded with "window.btoa" which only supports LATIN1/ASCII and could lead to locking users out, if they change their password to containing an UTF8-string like for example the German ä, ö, ü or French é, è, î etc. see subissue [BUG]: Username/Password base64 encoding bug #1915

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementEnhancement of existing features / Small additionuiHashtopolis UI related

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions