Unauthorized login after account creation

[he8us]

While looking at #862, I discovered that I have Unauthorized written in as only text when I try to login from localhost:8443

What I did:

1. npm run solid init
2. NODE_TLS_REJECT_UNAUTHORIZED=0 npm run solid start --no-reject-unauthorized
3. Create an account
4. Click on the login button on the Solid Home
5. Click on Login with localhost:8443

I'm running on node 8.12.0 through nvm and I already accessed that login page from the modal. I have no idea what changed since then.

After further investigations:

• When I open localhost:8443 in incognito mode, the login page appears
• When I remove solid-auth-client key from the Local Storage, I can login from the same browser

[he8us]

note: I might have restarted the server during the process

[megoth]

I've had the same problem earlier; I haven't understood the problem itself yet, but if you clear your localStorage you'll get another screen at least.

This usually happens after a restart of the server, so I'm guessing the tokens generated earlier is not valid after the server restart.

[kjetilk]

So, is this a security problem, like it sounds to be? Or could it be a symptom of a deeper vulnerability?

[he8us]

From the functional point of view, without the deep knowledge of the app, I view it like a session cookie that was still defined but the session was not found on the server (probably because it was stored in memory). Thus the server thinks that the client is unauthorized (which he is).

So no I don't think it's a security issue nor a vulnerability, it's more a UX issue since without the knowledge on how to clean your local storage, you're screwed as a user.

[megoth]

So no I don't think it's a security issue nor a vulnerability, it's more a UX issue since without the knowledge on how to clean your local storage, you're screwed as a user.

I agree.

This connects to how we handle the developer experience working with Solid. Don't know what we can do right now (as I need to understand the code better), but this is something we should handle better.