Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(auth): prevent authenticated route access after logout #247

Merged
merged 1 commit into from
Feb 3, 2025

Conversation

navaneeth0041
Copy link
Contributor

Description

This PR addresses a security vulnerability in the logout flow where users could access authenticated screens after logout by using the back button. The fix replaces context.push() with context.go() to properly clear the navigation stack upon logout.

Motivation:

  • Prevent unauthorized access to protected routes after logout
  • Improve security by ensuring proper session termination
  • Follow best practices for handling authentication state

Dependencies:

  • No new dependencies required
  • Uses existing go_router package

Fixes #246

Type of change

  • Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

Manual testing performed with the following test cases:

  1. Logout flow:
    • Navigate to settings
    • Click logout
    • Verify redirect to login screen
    • Attempt to use back button
    • Verify unable to access previous authenticated screens
WhatsApp.Video.2025-01-28.at.18.19.43.mp4

Checklist:

  • My code follows the style guidelines of this project
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • My changes generate no new warnings
  • I have checked my code and corrected any misspellings
  • The commit message follows the project's commit convention
  • I have made corresponding changes to the documentation
  • I have added tests that prove my fix is effective
  • New and existing unit tests pass locally with my changes
  • Any dependent changes have been merged and published in downstream modules

Maintainer Checklist

@navaneeth0041 navaneeth0041 requested a review from jddeep as a code owner January 28, 2025 12:51
Copy link
Collaborator

@mdmohsin7 mdmohsin7 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@mdmohsin7 mdmohsin7 merged commit 5f86b73 into AOSSIE-Org:develop Feb 3, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Fix: Prevent access to authenticated routes after logout via back button
2 participants