Repository navigation
Reset per-user state on logout, and validate messages in the recipe servers - #130
Merged
Merged
Conversation
close() now clears lastMessage, and feeds.reset(), runs.clear() and agent.reset() forget what the managers keep for the signed-in user. createTabsWebSocket takes a session option so tabs share a connection only within one user's session. outbox.clear() removes every entry that exists when it's called, whatever its timestamp. The authentication guide gets a section on logging out and switching accounts, and SECURITY.md says servers should close a user's sockets when their session ends.
Each recipe server parses and checks every message before using it and closes only the sender's socket with 1003 on bad input, where a malformed message used to stop the whole server. Every server socket gets an error listener. The live notifications recipe requires a SOCKET_SECRET of at least 32 characters and verifies tokens without throwing. The team chat, whiteboard and delivery tracking recipes clear their outbox on sign-out. The Next.js, Astro and Remix demo servers cap messages at 64 KiB, accept only palette colors and on-pad cursor positions, and their cursors paint the color with backgroundColor.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes from a security audit of 4.20.0.
Library: logging out and switching accounts
close()also clearslastMessage, as it already cleared the send queue and amigrate()target.feeds.reset(topic?),runs.clear(),agent.reset()(AG-UI), and asessionoption forcreateTabsWebSocketso tabs share a connection only within one user's session.outbox.clear()removes every entry that exists when it's called. It used to keep entries timestamped ahead of the clearing tab's clock.SECURITY.mdsays servers should close a user's sockets when their session ends.Recipes and examples
type, typed fields) and closes only the sender's socket with1003on bad input, instead of throwing and stopping the server. Every server socket has anerrorlistener.SOCKET_SECRETof at least 32 characters and verifies tokens without throwing.backgroundColor.Behavior changes
lastMessageshowundefinedafterclose()until a message arrives.10 new regression tests fail on the old code and pass now (469 total).
npm run check,check:package,size-limit, the example type checks anddocs:buildpass locally.