[keyserver] Add cookieHash to Viewer object
ClosedPublic
Actions

Authored by ashoat on Oct 22 2023, 3:29 PM.

Details

Reviewers

Commits

Summary

In the next diff, I'll need to access the cookieHash inside updateCookie to check if it's a bcrypt or sha256 hash.

Test Plan

Was tested in combination with next diff:

Log out on the web app
Check out a version of master with 397b4542fa7b38d8468038d74f3de84969f9dc36 and 12d02949bb4bb44a129163def1a7a056a7791b74 reverted
Log back in on the web app
Confirm that I have a bcrypt hash by running SELECT * FROM cookies ORDER BY last_used DESC LIMIT 1 in MariaDB console
Close web app tab, kill keyserver, and check out master + this diff + next diff
Open web app tab again
Confirm that I have a sha256 hash by rerunning query from step 4
Confirm that the cookie ID is the same between steps 4 and 7

Repository

rCOMM Comm

Lint

Lint Not Applicable

Unit

Tests Not Applicable

keyserver/src/session/viewer.js
216–219 ↗	(On Diff #32303)	This `invariant` may seem scary, but our usage in `cookieHash` in the next diff is addressed in that diff' description: It's safe to call `Viewer.cookieHash` and `Viewer.cookiePassword` in `updateCookie`, since `updateCookie` is only called for real, authenticated requests (HTML website, JSON responder, or WebSocket). `updateCookie` does not appear to be called with a bot or script viewer anywhere in the codebase. We have an equivalent `invariant`s for `cookiePassword` already that will trigger in this scenario anyways, so I don't think this should be problematic.