Skip to content

Websocket connection not authenticated after changing password #1079

Open
@hvanoch

Description

@hvanoch

Summary
Websocket connection is not authenticated properly when changing password and refreshing the page.

Steps to reproduce

  1. Login
  2. Open devtools
  3. Change password of logged in user
  4. Refresh the page

Actual Result

Console prints error:

Uncaught SyntaxError: Unexpected token H in JSON at position 0
    at JSON.parse (<anonymous>)

Expected Result
Websocket connection is authenticated

Details about your environment

  • OroPlatform version: 4.2.9
  • PHP version: 8.0.16

Additional information
Issue is that once the user is loaded in the entity manager, during the websocket server runtime, it is never refreshed from the database. So it will still use the old password (hash) for creating the ticket digest.
Reference: oro/platform/src/Oro/Bundle/SyncBundle/Security/TicketAuthenticationProvider.php:122
image

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions