whodis-react-storage-browser/dist/logic/storage/setTokenToStorage.js

React hooks and components for secure, best practices authentication in seconds

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.setTokenToStorage = void 0;
const simple_jwt_auth_1 = require("simple-jwt-auth");
const isServerSideRendering_1 = require("../../logic/env/isServerSideRendering");
const deleteSynchronizationCookie_1 = require("../../logic/synchronization/deleteSynchronizationCookie");
const key_1 = require("./key");
const setTokenToStorage = ({ token }) => {
    // ensure that we only try to set tokens on client side; tokens can only be properly set on client side - where the cookie is properly set for the user and the anti-csrf token is set in localstorage
    if ((0, isServerSideRendering_1.isServerSideRendering)())
        throw new Error('attempted to set token on server side'); // fail fast, as this should never occur and is a problem with our code if it does
    // if the token is not signature redacted, throw an error - should never occur - since if this does, its an XSS vulnerability
    if (token && token !== (0, simple_jwt_auth_1.redactSignature)({ token }))
        throw new Error('non-signature-redacted token was attempted to be saved by client-side javascript. should not be occurring'); // fail fast if this occurs; this should be handled by whodis-client already and never should occur
    // set the value of the token into local storage
    localStorage.setItem(key_1.TOKEN_STORAGE_KEY, token !== null && token !== void 0 ? token : 'null');
    // and, if the token was being removed, wipe out the synchronization cookie too, so the server-side will be aware of this too
    if (token === null)
        (0, deleteSynchronizationCookie_1.deleteSynchronizationCookie)();
    // last, emit an event about this occurring
};
exports.setTokenToStorage = setTokenToStorage;
//# sourceMappingURL=setTokenToStorage.js.map