CVE-2024-29036: Insufficient Information (NVD-CWE-noinfo)
value: Saleor Storefront is software for building e-commerce experiences. Prior to commit 579241e75a5eb332ccf26e0bcdd54befa33f4783, when any user authenticates in the storefront, anonymous users are able to access their data. The session is leaked through cache and can be accessed by anyone. Users should upgrade to a version that incorporates commit 579241e75a5eb332ccf26e0bcdd54befa33f4783 or later to receive a patch. A possible workaround is to temporarily disable authentication by changing the usage of `createSaleorAuthClient()`.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-20T21:15Z
Repository: https://github.com/saleor/auth-sdk
Language: Markdown
Files changed: README.md
Commit date: 2024-03-15 21:36:14 +0100
Commit message: Update README

Diff: diff --git a/README.md b/README.md
index 33f73b6..e94e1d2 100644
--- a/README.md
+++ b/README.md
@@ -40,27 +40,29 @@ In order to use Saleor Auth SDK in React Server Components, the client needs to
 
 ```ts
 import { createSaleorAuthClient } from "@saleor/auth-sdk";
 import { getNextServerCookiesStorage } from "@saleor/auth-sdk/next/server";
 
-const nextServerCookiesStorage = getNextServerCookiesStorage();
-const saleorAuthClient = createSaleorAuthClient({
-  saleorApiUrl: "…",
-  refreshTokenStorage: nextServerCookiesStorage,
-  accessTokenStorage: nextServerCookiesStorage,
-});
+const getServerAuthClient = () => {
+  const nextServerCookiesStorage = getNextServerCookiesStorage();
+  returncreateSaleorAuthClient({
+    saleorApiUrl: "…",
+    refreshTokenStorage: nextServerCookiesStorage,
+    accessTokenStorage: nextServerCookiesStorage,
+  });
+};
 ```
 
 Logging in can be implemented via Server Actions:
 
 ```tsx
 <form
   className="bg-white shadow-md rounded p-8"
   action={async (formData) => {
     "use server";
 
-    await saleorAuthClient.signIn(
+    await getServerAuthClient().signIn(
       {
         email: formData.get("email").toString(),
         password: formData.get("password").toString(),
       },
       { cache: "no-store" },
@@ -71,11 +73,11 @@ Logging in can be implemented via Server Actions:
 </form>
 ```
 
 Then, you can use `saleorAuthClient.fetchWithAuth` directly for any queries and mutations.
 
-For a full working example see the [Saleor Auth SDK example](https://github.com/saleor/example-auth-sdk/blob/5babda35969c35f423680b47d1446466b18b2461/app/ssr/page.tsx).
+For a full working example, see the [Saleor Auth SDK example](https://github.com/saleor/example-auth-sdk/tree/app/ssr/page.tsx).
 
 ### Next.js Pages Router with [Apollo Client](https://www.apollographql.com/docs/react/)
 
 <details>
   <summary>Step-by-step video tutorial</summary>

Vulnerable code: const nextServerCookiesStorage = getNextServerCookiesStorage();
const saleorAuthClient = createSaleorAuthClient({
  saleorApiUrl: "…",
  refreshTokenStorage: nextServerCookiesStorage,
  accessTokenStorage: nextServerCookiesStorage,
});
    await saleorAuthClient.signIn(
For a full working example see the [Saleor Auth SDK example](https://github.com/saleor/example-auth-sdk/blob/5babda35969c35f423680b47d1446466b18b2461/app/ssr/page.tsx).
Fixed code: const getServerAuthClient = () => {
  const nextServerCookiesStorage = getNextServerCookiesStorage();
  returncreateSaleorAuthClient({
    saleorApiUrl: "…",
    refreshTokenStorage: nextServerCookiesStorage,
    accessTokenStorage: nextServerCookiesStorage,
  });
};
    await getServerAuthClient().signIn(
For a full working example, see the [Saleor Auth SDK example](https://github.com/saleor/example-auth-sdk/tree/app/ssr/page.tsx).