Security identity in Globals bug. version 6.5.5

@patrick don't know if this helps but:

Works fine on AC1
On AC2 I can see this new output:

  server-connect:router Serving serverConnect /api/testlogin/login +0ms
  server-connect:app Executing action step login +0ms
  server-connect:app options: { provider: 'security2', username: '{{$_POST.email}}' } +0ms
  server-connect:auth No login cookie found +0ms
(node:17324) TimeoutOverflowWarning: 86400000000 does not fit into a 32-bit signed integer.
Timeout duration was set to 1.
(Use `node --trace-warnings ...` to show where the warning was created)

So I went to VS and running node --trace-warnings index.js:

  server-connect:router Serving serverConnect /api/testlogin/login +0ms
  server-connect:app Executing action step login +0ms
  server-connect:app options: { provider: 'security2', username: '{{$_POST.email}}' } +0ms
  server-connect:auth No login cookie found +0ms
(node:2016) TimeoutOverflowWarning: 86400000000 does not fit into a 32-bit signed integer.
Timeout duration was set to 1.
    at new Timeout (node:internal/timers:173:17)
    at setTimeout (node:timers:164:19)
    at ExtendedMap.set (C:\xampp\htdocs\test_node\lib\core\memoryStore.js:13:30)
    at MemoryStore.set (C:\xampp\htdocs\test_node\lib\core\memoryStore.js:44:23)
    at Session.save (C:\xampp\htdocs\test_node\node_modules\express-session\session\session.js:72:25)
    at ServerResponse.end (C:\xampp\htdocs\test_node\node_modules\express-session\index.js:343:21)
    at res.end (C:\xampp\htdocs\test_node\node_modules\express-end\index.js:15:15)
    at ServerResponse.send (C:\xampp\htdocs\test_node\node_modules\express\lib\response.js:233:10)
    at ServerResponse.json (C:\xampp\htdocs\test_node\node_modules\express\lib\response.js:279:15)
    at App.exec (C:\xampp\htdocs\test_node\lib\core\app.js:585:22)

Another one:

Setting remember me to 1 on login step:

Seems to work:
image

server-connect:auth setCookie 1 user1@mail.com 1234 +3ms
(node:31696) TimeoutOverflowWarning: 86400000000 does not fit into a 32-bit signed integer.
Timeout duration was set to 1.
1 Like

I think there's definitely a bug with docker/ node as I'm having the exact same problem. When logging in the basic functionality works - log in is successful if user/password is correct and fails if wrong password.

The problem is after that security identify always returns false.

Really simple server connect:
image

Response:
image

This is with security restrict off. Obviously if you add a security restrict you just get booted back to the log in screen (or wherever you set).

This is the simple log in
image

Could you please look at this asap as this is really important functionality?!

Thanks

1 Like

Just to add - I added 1 to remember and that seems to fix it

i rolled back to a downloaded version i have; 6.5.0. project works after extension update on older version.

wondering if there is an official download location from where i can get version 6.5.4
or 6.5.3. availing last few versions for this kind of situation will help work on the project without waiting for next version fix.

Hi @PaulS
Before to roll back version, please test using another Session Store, maybe database or redis, looks like memory options have the issue, like this:

Looks like same issue:
https://community.wappler.io/t/session-store-option-memory-remove-additional-data-during-login/56573/2

I am having the same issues. With 2 different projects. Login function is successful, but then when redirecting using a roles query, using the security identity, it returns false and the query fails.

I then reverted to the previous commit before the updated files of 6.5.5, and it works.

I hope this can be fixed asap as it is a crucial issue.

Thanks all!

I thought I broke my login system inadvertently, glad I looked here first

Changed to bug report

If you're on windows:
https://account5.wappler.io/download/Wappler-win64-6.5.4.exe

2 Likes

Glad that I saw this post. I am experiencing the same issue. Unless I tick remember me when logging in, I get false value for the identity from the security provider.

Can we have a fix to this issue please? Thanks.

@franse

The TimeoutOverflowWarning is indeed a bug that I'm currently investigating, after login/logout the session is regenerated and old session data copied to the new session but the error prevents that. When regenerating the session you get also a new cookie and old session is invalidated to prevent session fixation attacks.

For the overflow error an update can be downloaded at

2 Likes

Seems the fix does the trick and everything is normal again, identity is back.
Maybe others can check that as well on their project.

fix works for me as long as server connect component is not updated on prompt when the project is re/started.

Yes, that is how it works, the fix will come in the next update.

1 Like

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.

Fixed in Wappler 6.6.0