Skip to content

fix: namespace auth token storage key to prevent cross-instance sessi… - #1405

Open
swarnendusahu10-dotcom wants to merge 1 commit into
RocketChat:developfrom
swarnendusahu10-dotcom:fix/issue-1105-cross-instance-auth-isolation
Open

swarnendusahu10-dotcom wants to merge 1 commit into
RocketChat:developfrom
swarnendusahu10-dotcom:fix/issue-1105-cross-instance-auth-isolation

Conversation

@swarnendusahu10-dotcom

Copy link
Copy Markdown
Contributor

Summary

Closes #1105

When multiple EmbeddedChat instances (e.g. Sales Bot and Support Bot, or multi-tenant widgets) co-exist on the same domain, logging into one instance previously overwrote the authentication session of the other because the localStorage key was hardcoded to 'ec_token' in packages/react/src/lib/auth.js.

This pull request introduces host-scoped namespaced token storage keys with an opt-in tokenStorageKey prop override and automatic backward-compatible session migration.


Key Changes

  1. Dynamic Namespaced Storage Keys (packages/react/src/lib/auth.js):

    • Refactored getTokenStorage(secure, key) and local storage helpers to accept a configurable storage key.
    • Preserves asynchronous function signatures.
    • Seamless backward compatibility: if a namespaced key is empty, getTokenLocalStorage falls back to and migrates any existing legacy 'ec_token' session so existing users are never logged out upon upgrading.
  2. Host-Scoped Resolution & Memoization (packages/react/src/views/EmbeddedChat.js):

    • Automatically scopes the default storage key to ec_token_${normalizedHost}, ensuring different servers maintain completely independent sessions.
    • Crucially avoids room-based scoping (roomId), ensuring that switching channels within the same chat instance does not log the user out.
    • Adds an optional tokenStorageKey prop with PropTypes coverage for integrators needing custom instance isolation on the same host.
    • Wraps getTokenStorage(secure, storageKey) in useMemo to eliminate unnecessary function recreations and prevent redundant RCInstance re-renders.

Verification

  • Verified cross-instance session isolation: logging into Instance A (https://sales.example.com) does not overwrite Instance B (https://support.example.com).
  • Verified room navigation: switching rooms within the same host preserves authentication.
  • Verified backward compatibility: existing sessions saved under legacy 'ec_token' migrate seamlessly without user intervention.
  • Formatted with Prettier (npx prettier --check).
  • Clean monorepo build with npm run build (dist/cjs and dist/esm generated without errors).

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: Cross-Instance Authentication Corruption via Hardcoded ec_token Key

1 participant