Cookie expiration bug

[glynnbird]

Cookie expiration bug

[glynnbird]

Fixed in 10.1.2

[YakovL]

Hey @glynnbird , thanks for the fix! However, I've figured that for me the source of the issue is different (I've updated to 10.1.2). It looks like the auth is "forgotten" after I hybernate my laptop and then wake it up again. Sure, this is not a big issue for production as servers are not hibernated normally (I guess), but still this looks like a buggy behavior. Should I create a new issue for this?

[glynnbird]

A couchdb cookie has a lifetime of 60 mins by default. If your client app sleeps for over 60 minutes then it will no longer be authenticated so will not get a refreshed cookie. So if you're planning on being inactive for over an hour you should reauth on wake up. This isn't a bug.

…

On Tue, 31 Jan 2023, 19:25 Yakov Litvin, ***@***.***> wrote: Hey @glynnbird <https://github.com/glynnbird> , thanks for the fix! However, I've figured that for me the source of the issue is different (I've updated to 10.1.2). It looks like the auth is "forgotten" after I hybernate my laptop and then wake it up again. Sure, this is not a big issue for production as servers are not hibernated normally (I guess), but still this looks like a buggy behavior. Should I create a new issue for this? — Reply to this email directly, view it on GitHub <#324 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAFKMROU6YCR3BB2MWYVJC3WVFRLPANCNFSM6AAAAAAUHRFMMU> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[YakovL]

Right, I see. I'm thinking about a way to make sure we're authorized before each request

private get authedClientPromise(): Promise<nanoClient.ServerScope> {
    return (async () => {
        // TODO: check if we are authed
        // TODO: if not, do this.client.auth(...)
        return this.client
    })()
}

Could you suggested a proper way to do the "is authed" check? I understand that we can send a request, check if we got 401 and try to reauth in that case, but doing this in each method is very WET (although better in terms of performance: the "is authed" check is an additional request).

May be it's possible to check the cookie expiration without a request? I'm not finding a dedicated method for this.

[glynnbird]

@YakovL

You can call:

const doc = await nano.session()

which will tell you if you're logged in or not, and if you are, what permissions you have.

[YakovL]

Great, thanks, currently I'm using something like this

const session = await nano.session()

// 'cookie' when we're good and undefined otherwise
const isAuthed = session.info.authenticated

if(!isAuthed) await nano.auth(user, password)

and it works fine, although this doubles the number of requests to db.