Merge pull request #1340 from solid/fix/1317

Fix/1317 (User not logged in 2)

Author: jaxoncreed

lib/create-app.js

@@ -296,6 +296,7 @@ function initAuthentication (app, argv) {
  */
 function sessionSettings (secureCookies, host) {
   let sessionSettings = {
+    name: 'nssidp.sid',
     secret: uuid.v1(),
     saveUninitialized: false,
     resave: false,

lib/requests/sharing-request.js

@@ -82,6 +82,8 @@ class SharingRequest extends AuthRequest {
       } else {
         request.renderForm(null, req, appOrigin)
       }
+    } else {
+      request.redirectPostSharing()
     }
   }
 
@@ -119,6 +121,8 @@ class SharingRequest extends AuthRequest {
 
       // Redirect once that's all done
       request.redirectPostSharing()
+    } else {
+      request.redirectPostSharing()
     }
   }
 
@@ -144,12 +148,7 @@ class SharingRequest extends AuthRequest {
 
   isUserLoggedIn () {
     // Ensure the user arrived here by logging in
-    if (!this.session.subject || !this.session.subject._id) {
-      this.response.status(401)
-      this.response.send('User not logged in 2')
-      return false
-    }
-    return true
+    return !!(this.session.subject && this.session.subject._id)
   }
 
   getAppUrl () {

test/integration/authentication-oidc-test.js

@@ -137,7 +137,7 @@ describe('Authentication API (OIDC)', () => {
       })
 
       it('should set the cookie', () => {
-        expect(cookie).to.match(/connect.sid=\S{65,100}/)
+        expect(cookie).to.match(/nssidp.sid=\S{65,100}/)
       })
 
       it('should set the cookie with HttpOnly', () => {
@@ -247,7 +247,7 @@ describe('Authentication API (OIDC)', () => {
         describe('with malicious cookie but without origin', () => {
           let response
           before(done => {
-            var malcookie = cookie.replace(/connect\.sid=(\S+)/, 'connect.sid=l33th4x0rzp0wn4g3;')
+            var malcookie = cookie.replace(/nssidp\.sid=(\S+)/, 'nssidp.sid=l33th4x0rzp0wn4g3;')
             alice.get('/private-for-alice.txt')
               .set('Cookie', malcookie)
               .end((err, res) => {
@@ -353,7 +353,7 @@ describe('Authentication API (OIDC)', () => {
         describe('with malicious cookie but with globally configured origin', () => {
           let response
           before(done => {
-            var malcookie = cookie.replace(/connect\.sid=(\S+)/, 'connect.sid=l33th4x0rzp0wn4g3;')
+            var malcookie = cookie.replace(/nssidp\.sid=(\S+)/, 'nssidp.sid=l33th4x0rzp0wn4g3;')
             alice.get('/private-for-alice.txt')
               .set('Cookie', malcookie)
               .set('Origin', 'https://apps.solid.invalid')
@@ -407,7 +407,7 @@ describe('Authentication API (OIDC)', () => {
         describe('with malicious cookie and our origin', () => {
           let response
           before(done => {
-            var malcookie = cookie.replace(/connect\.sid=(\S+)/, 'connect.sid=l33th4x0rzp0wn4g3;')
+            var malcookie = cookie.replace(/nssidp\.sid=(\S+)/, 'nssidp.sid=l33th4x0rzp0wn4g3;')
             alice.get('/private-for-alice.txt')
               .set('Cookie', malcookie)
               .set('Origin', aliceServerUri)
@@ -425,7 +425,7 @@ describe('Authentication API (OIDC)', () => {
         describe('with malicious cookie and a non-matching origin', () => {
           let response
           before(done => {
-            var malcookie = cookie.replace(/connect\.sid=(\S+)/, 'connect.sid=l33th4x0rzp0wn4g3;')
+            var malcookie = cookie.replace(/nssidp\.sid=(\S+)/, 'nssidp.sid=l33th4x0rzp0wn4g3;')
             alice.get('/private-for-owner.txt')
               .set('Cookie', malcookie)
               .set('Origin', bobServerUri)
@@ -455,7 +455,7 @@ describe('Authentication API (OIDC)', () => {
 
         describe('with trusted app and malicious cookie', () => {
           before(done => {
-            var malcookie = cookie.replace(/connect\.sid=(\S+)/, 'connect.sid=l33th4x0rzp0wn4g3;')
+            var malcookie = cookie.replace(/nssidp\.sid=(\S+)/, 'nssidp.sid=l33th4x0rzp0wn4g3;')
             alice.get('/private-for-alice.txt')
                  .set('Cookie', malcookie)
                  .set('Origin', trustedAppUri)

test/integration/authentication-oidc-with-strict-origins-turned-off-test.js

@@ -134,7 +134,7 @@ describe('Authentication API (OIDC) - With strict origins turned off', () => {
       })
 
       it('should set the cookie', () => {
-        expect(cookie).to.match(/connect.sid=\S{65,100}/)
+        expect(cookie).to.match(/nssidp.sid=\S{65,100}/)
       })
 
       it('should set the cookie with HttpOnly', () => {
@@ -286,7 +286,7 @@ describe('Authentication API (OIDC) - With strict origins turned off', () => {
           let malcookie
           before(() => {
             // How Mallory might set their cookie:
-            malcookie = cookie.replace(/connect\.sid=(\S+)/, 'connect.sid=l33th4x0rzp0wn4g3;')
+            malcookie = cookie.replace(/nssidp\.sid=(\S+)/, 'nssidp.sid=l33th4x0rzp0wn4g3;')
           })
           describe('and no origin set', () => {
             before(done => {