whodis-react-storage-browser/dist/logic/synchronization/isTokenSynchronized.js

React hooks and components for secure, best practices authentication in seconds

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.isTokenSynchronized = void 0;
const cross_sha256_1 = require("cross-sha256");
const simple_cookie_client_1 = require("simple-cookie-client");
const simple_in_memory_cache_1 = require("simple-in-memory-cache");
const simple_jwt_auth_1 = require("simple-jwt-auth");
const with_simple_caching_1 = require("with-simple-caching");
const toSha256 = (0, with_simple_caching_1.withSimpleCaching)((input) => new cross_sha256_1.sha256().update(input).digest('hex'), {
    cache: (0, simple_in_memory_cache_1.createCache)(), // cache the result in memory to prevent redundant computation
});
/**
 * determines whether the token is synchronized across both environment's storages, to ensure consistent responses
 *
 * why?
 * - browser.localstorage.authorization and browser.cookie.authorization can get out of sync
 *   - why?
 *     - browser.localstorage is scoped to each full domain (www.ahbode.com != subdomain.ahbode.com) and per mobile in-app browser launch
 *     - browser.cookie is scoped simply per browser
 * - when the two are out of sync, sad things happen
 *   - the serverside, which reads only from browser.cookie.authorization, thinks the user is logged in
 *   - the clientside, which only has the anti-csrf-token in localstorage, can not make authenticated requests -> is effectively logged out
 *   - the serverside will not redirect the clientside to login before seeing this no longer authorized data
 *   - the clientside will subsequently break as it tries to make requests it looks like its authorized to do and get back an unauthorized response
 *   - at best, the client has a bad experience
 *   - at worst, the client saw data they were no longer authorized to see
 * - to ensure this does not happen, we can use a synchronization token that both the server and the client are allowed to see and modify
 *   - the client can whether it's anti-csrf-token in localstorage in sync with the token that the server has, by comparing the value to the token it has
 *   - the server can whether the client has been logged out, by checking if the value is now null
 */
const isTokenSynchronized = ({ token }) => {
    // lookup the synchronization cookie
    const synchronizationCookie = (0, simple_cookie_client_1.getCookie)({ name: 'synchronization' });
    if (!synchronizationCookie)
        return false; // if no synchronization cookie, not synchronized (e.g., maybe user logged out)
    // check that the tokens are in sync
    const tokenUuidHashExpected = synchronizationCookie.value.split(':')[0];
    const tokenUuidHashFound = toSha256((0, simple_jwt_auth_1.getUnauthedClaims)({ token }).jti);
    return tokenUuidHashExpected === tokenUuidHashFound;
};
exports.isTokenSynchronized = isTokenSynchronized;
//# sourceMappingURL=isTokenSynchronized.js.map