Open
Description
Summary
Websocket connection is not authenticated properly when changing password and refreshing the page.
Steps to reproduce
- Login
- Open devtools
- Change password of logged in user
- Refresh the page
Actual Result
Console prints error:
Uncaught SyntaxError: Unexpected token H in JSON at position 0
at JSON.parse (<anonymous>)
Expected Result
Websocket connection is authenticated
Details about your environment
- OroPlatform version: 4.2.9
- PHP version: 8.0.16
Additional information
Issue is that once the user is loaded in the entity manager, during the websocket server runtime, it is never refreshed from the database. So it will still use the old password (hash) for creating the ticket digest.
Reference: oro/platform/src/Oro/Bundle/SyncBundle/Security/TicketAuthenticationProvider.php:122