Skip to content

Commit

Permalink
Allow developers to enable auto-login for their frontend
Browse files Browse the repository at this point in the history
With this change, the `setAutoLoginCredentials()` function gets exposed as a public API. While it should be used with extreme care (since using it means hard-coding the NATS credentials into the built frontends), this enables developers to enable auto-login in their Telestion based frontends by calling:

```tsx
setAutoLoginCredentials({
	natsUrl: 'ws://localhost:9222',
	username: 'nats',
	password: 'nats'
});
```

While there are, obviously, security risks associated with this, some use-cases require such functionality which is why it gets exposed as an official API to at least make it as secure as possible by tightly integrating it into the core framework. To make developers aware of the security implications, they are described in the documentation and the function is marked as `@deprecated` for extra attention.
  • Loading branch information
pklaschka committed Jan 17, 2024
1 parent b246181 commit dce62c6
Show file tree
Hide file tree
Showing 3 changed files with 28 additions and 3 deletions.
7 changes: 7 additions & 0 deletions frontend-react/src/app/index.tsx
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
import { initTelestion, registerWidgets, UserData } from '../lib';
import { simpleWidget } from './widgets/simple-widget';
import { errorWidget } from './widgets/error-widget';
import { setAutoLoginCredentials } from '../lib/auth';

const defaultUserData: UserData = {
version: '0.0.1',
Expand Down Expand Up @@ -29,6 +30,12 @@ const defaultUserData: UserData = {

registerWidgets(simpleWidget, errorWidget);

setAutoLoginCredentials({
natsUrl: 'ws://localhost:9222',
username: 'nats',
password: 'nats'
});

await initTelestion({
version: '0.0.1',
defaultBackendUrl: 'ws://localhost:9222',
Expand Down
22 changes: 20 additions & 2 deletions frontend-react/src/lib/auth/auto-login.ts
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,17 @@ import { z } from 'zod';
const AUTO_LOGIN_KEY = 'auto-login';

const autoLoginSchema = z.object({
/**
* The URL of the NATS server to connect to.
*/
natsUrl: z.string(),
/**
* The username to use when connecting to the NATS server.
*/
username: z.string(),
/**
* The password to use when connecting to the NATS server.
*/
password: z.string()
});

Expand Down Expand Up @@ -51,10 +60,19 @@ export async function attemptAutoLogin(): Promise<boolean> {
}

/**
* @internal
* Store auto-login credentials in sessionStorage.
* Sets credentials with which to auto-login.
*
* If an auto-login attempt fails, the credentials will be cleared for the remainder of the session and a login form
* shown to the user. If the user logs in successfully, the credentials will be updated.
*
* ### Security Warning
*
* Use this function only if user authentication is handled by a separate system. Calling this function in
* your application means your NATS credentials will be hard-coded into your application, which is a security risk.
*
* @param credentials - The credentials to store
* @deprecated No, this won't be removed anytime soon. You can ignore this warning if you're aware of the security
* implications.
*/
export function setAutoLoginCredentials(
credentials: z.input<typeof autoLoginSchema>
Expand Down
2 changes: 1 addition & 1 deletion frontend-react/src/lib/auth/index.ts
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
export * from './model.ts';
export * from './state.ts';
export * from './controller.ts';
export { attemptAutoLogin } from './auto-login.ts';
export { attemptAutoLogin, setAutoLoginCredentials } from './auto-login.ts';
export * from './hooks';

0 comments on commit dce62c6

Please sign in to comment.