fix(auth): verify one-time token before fetching session - #484
Conversation
The crossDomain plugin creates a one-time token (ott) after OAuth callback and redirects to frontend with ?ott=token. However, the frontend never verified this token before fetching the session, causing auth to get stuck showing 'Sign in with GitHub' even after successful OAuth. This fix: - Checks for ott param in URL on mount - Verifies token via crossDomain.oneTimeToken.verify() before fetching session - Removes ott from URL after processing to prevent re-verification
|
🚅 Deployed to the openchat-pr-484 environment in OpenChat
|
🚀 Preview Deployment Ready
Convex Preview Backend
🤖 Deployed automatically by GitHub Actions |
Greptile SummaryFixed authentication stuck state after GitHub OAuth redirect by verifying one-time token before fetching session. Key Changes
How It WorksThe Issues Found
Confidence Score: 4/5
Important Files Changed
Sequence DiagramsequenceDiagram
participant User
participant Frontend
participant AuthServer as Better Auth
participant GitHub
participant Provider as StableAuthProvider
User->>Frontend: Click sign in
Frontend->>AuthServer: Start OAuth flow
AuthServer->>GitHub: OAuth request
GitHub->>User: Authorization prompt
User->>GitHub: Approve
GitHub->>AuthServer: OAuth callback
AuthServer->>AuthServer: Create one-time credential
AuthServer->>Frontend: Redirect with ott param
Note over Provider: BEFORE FIX
Provider->>AuthServer: fetchSession immediately
AuthServer-->>Provider: No valid session yet
Provider->>Provider: Auth gets stuck
Note over Provider: AFTER FIX
Provider->>Provider: Check URL for ott
Provider->>AuthServer: Verify ott credential
AuthServer-->>Provider: Session created
Provider->>Provider: Clean URL params
Provider->>AuthServer: fetchSession
AuthServer-->>Provider: Return session
Provider->>User: Successfully authenticated
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| authClient.crossDomain.oneTimeToken | ||
| .verify({ token: ott }) | ||
| .then(() => { | ||
| const url = new URL(window.location.href); | ||
| url.searchParams.delete("ott"); | ||
| window.history.replaceState({}, "", url.toString()); | ||
| }) | ||
| .catch((err: unknown) => { | ||
| console.error("Failed to verify one-time token:", err); | ||
| }) | ||
| .finally(() => { | ||
| fetchSession(); | ||
| }); |
There was a problem hiding this comment.
logic: If verify() fails, fetchSession() still runs in .finally(). This means a failed/invalid token still attempts session fetch, which may not be the intended behavior - you might want to skip fetchSession() on verification failure.
Confidence: 3/5 - Depends on whether you want to attempt session fetch even with invalid ott tokens (could be intentional fallback behavior)
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
| const urlParams = new URLSearchParams(window.location.search); | ||
| const ott = urlParams.get("ott"); |
There was a problem hiding this comment.
style: Consider extracting window.location.search to a variable since it's used twice (here and in line 201 via window.location.href)
| const urlParams = new URLSearchParams(window.location.search); | |
| const ott = urlParams.get("ott"); | |
| const urlParams = new URLSearchParams(window.location.search); |
Confidence: 2/5 - Minor style improvement, not critical
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
1 participant
Summary
Fixes the auth getting stuck after GitHub OAuth redirect. Users were seeing "Sign in with GitHub" even after successful authentication.
Root Cause
The
crossDomainplugin creates a one-time token (ott) after OAuth callback and redirects to the frontend with?ott=token. However, theStableAuthProviderwas fetching the session immediately on mount without verifying the ott token first, causing auth to fail silently.Changes
ottparameter in URL on component mountauthClient.crossDomain.oneTimeToken.verify()before fetching sessionottfrom URL after processing to prevent re-verification on refreshTesting
bun check-types)bun run buildin apps/web)