Skip to content

Force signout unauthorized users#96

Open
kungpaogao wants to merge 4 commits intobetafrom
kungpaogao/security-force-sign-out
Open

Force signout unauthorized users#96
kungpaogao wants to merge 4 commits intobetafrom
kungpaogao/security-force-sign-out

Conversation

@kungpaogao
Copy link
Member

Summary

This pull request adds a frontend query to check if user is authorized (i.e., user is in the users Firestore collection) whenever anyone tries to login.

Test Plan

screen recording later

To test this out, try logging in with a non-authorized account (e.g., your personal Google account). It should load and attempt to login, then immediately kick you out.

With an authorized user, the flow should be normal.

Next Steps

To be safe, we should probably make this a backend function that just returns a boolean value. This way, the client doesn't have access to the whole users collection.

@kungpaogao kungpaogao added the security Issue related to security label May 12, 2021
@kungpaogao kungpaogao requested a review from kira-segenchuk May 12, 2021 17:11
@kungpaogao kungpaogao self-assigned this May 12, 2021
@github-actions
Copy link

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

security Issue related to security

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant