Skip to content

Users signed in using OAuth have only 1 sessionToken per Sign-In #4328

Closed

Description

@cipiripper

Issue Description

We use Google OAuth to sign in users to to parse-server. We require users to be signed in from multiple devices.

If user signs in from website using his Google account (parse JS SDK), he gets session token r:AAA.
Then he signs in on mobile device (parse IOS SDK), gets session token r:BBB, and token r:AAA gets removed, and website session signed out.

Problem seems to be in RestWrite.js :338, there session gets deleted from local cache, and from MongoDB as well.

This doesn't happen if user signs in using parse-server username/password combination.

Expected Results

User should have both sessions available, and active on both devices. This is how it used to be on parse.com, right?...

Actual Outcome

Only user's last session is active.

Environment Setup

  • Server

    • parse-server version: 2.6.2
    • Operating System: Ubuntu 16.04
    • Hardware: AWS EC2 c3.2xlarge instnace
    • Localhost or remote server: Remote, AWS
  • Database

    • Localhost or remote server: ObjectRocket

Activity

  1. cipiripper commented on Nov 8, 2017

    @cipiripper
    ContributorAuthor

    Okay this as well RestWrite.js:

    // Destroy the sessions in 'Background'
      this.config.database.destroy('_Session', {
        user: {
          __type: 'Pointer',
          className: '_User',
          objectId: this.objectId()
        },
        installationId: this.auth.installationId,
        sessionToken: { '$ne': token },
      });
    

    So when user logs in, all his SessionTokens from this installationId get removed... Why(infinity * ?)

  2. flovilmart commented on Nov 8, 2017

    @flovilmart
    Contributor

    this only destroy the session for the this.auth.installationId so should never affect other sessions that were created on other devices.

  3. montymxb commented on Nov 8, 2017

    @montymxb
    Contributor

    @cipiripper Looking back in the history it looks like this was changed in #4143 to address #2885, as this was a bug and not expected functionality. You can see this is noted in the docs as well. The history there indicates this language was present in the initial commit so it probably was the same for parse.com.
    Disregard for comment below, although the change above was for a bug fix it was not something that should have an impact on this issue.

  4. montymxb commented on Nov 8, 2017

    @montymxb
    Contributor

    To agree with @flovilmart this shouldn't cause you a problem as it's just clearing duplicates for multiple sessions with the same installationId. The device and browser session shouldn't conflict with each other in this regard, unless a matching installationId was being set onto the web session for some reason.

  5. cipiripper commented on Nov 8, 2017

    @cipiripper
    ContributorAuthor
  6. stale commented on Sep 18, 2018

    @stale

    This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions