Repository: auth0/auth0.js
Pull request #575 (2017-11-28 20:48:14)

 Return sso:false when lastUsedSub is different from checkSession's sub 


Patch:
diff --git a/src/authentication/index.js b/src/authentication/index.js
index 147cc0b..f18ba0e 100644
--- a/src/authentication/index.js
+++ b/src/authentication/index.js
@@ -355,6 +355,8 @@ Authentication.prototype.loginWithResourceOwner = function(options, cb) {
  */
 Authentication.prototype.getSSOData = function(cb) {
   var clientId = this.baseOptions.clientID;
+  var ssodataInformation = ssodata.get() || {};
+
   this.auth0.checkSession(
     {
       responseType: 'id_token',
@@ -371,12 +373,17 @@ Authentication.prototype.getSSOData = function(cb) {
         }
         return cb(err, { sso: false });
       }
-      var ssodataInformation = ssodata.get() || {};
+      if (
+        ssodataInformation.lastUsedSub &&
+        ssodataInformation.lastUsedSub !== result.idTokenPayload.sub
+      ) {
+        return cb(err, { sso: false });
+      }
       return cb(null, {
         lastUsedConnection: {
           name: ssodataInformation.lastUsedConnection
         },
-        lastUsedUserID: result.idTokenPayload.sub,
+        lastUsedUserID: ssodataInformation.lastUsedSub,
         lastUsedUsername: ssodataInformation.lastUsedUsername,
         lastUsedClientID: clientId,
         sessionClients: [clientId],
diff --git a/src/helper/ssodata.js b/src/helper/ssodata.js
index b885ae1..05631d5 100644
--- a/src/helper/ssodata.js
+++ b/src/helper/ssodata.js
@@ -1,10 +1,11 @@
 var storage = require('./storage');
 
 module.exports = {
-  set: function(connection, username) {
+  set: function(connection, username, sub) {
     var ssodata = {
       lastUsedUsername: username,
-      lastUsedConnection: connection
+      lastUsedConnection: connection,
+      lastUsedSub: sub
     };
     storage.setItem('auth0.ssodata', JSON.stringify(ssodata));
   },
diff --git a/src/web-auth/index.js b/src/web-auth/index.js
index 64e9d2f..7bc25cd 100644
--- a/src/web-auth/index.js
+++ b/src/web-auth/index.js
@@ -196,11 +196,13 @@ WebAuth.prototype.validateAuthenticationResponse = function(options, parsedHash,
     }
     if (transaction && transaction.lastUsedConnection) {
       var username = transaction.lastUsedUsername;
+      var sub;
       if (payload) {
         var payloadUsername = payload.email || payload.name;
         username = payloadUsername || username;
+        sub = payload.sub;
       }
-      ssodata.set(transaction.lastUsedConnection, username);
+      ssodata.set(transaction.lastUsedConnection, username, sub);
     }
     return cb(null, buildParseHashResponse(parsedHash, appState, payload));
   };


Test patch:
diff --git a/test/authentication/authentication.test.js b/test/authentication/authentication.test.js
index 014c0a0..9c921f4 100644
--- a/test/authentication/authentication.test.js
+++ b/test/authentication/authentication.test.js
@@ -236,7 +236,8 @@ describe('auth0.authentication', function() {
         expect(key).to.be('auth0.ssodata');
         return JSON.stringify({
           lastUsedConnection: 'lastUsedConnection',
-          lastUsedUsername: 'lastUsedUsername'
+          lastUsedUsername: 'lastUsedUsername',
+          lastUsedSub: 'the-user-id'
         });
       });
     });
@@ -259,6 +260,17 @@ describe('auth0.authentication', function() {
 
       this.webAuthSpy.checkSession.lastCall.args[1]({ some: 'error' });
     });
+    it("returns sso:false if lastUsedSub is different from checkSesion's sub", function(done) {
+      this.auth0.getSSOData(function(err, result) {
+        expect(err).to.be.eql(null);
+        expect(result).to.be.eql({ sso: false });
+        done();
+      });
+
+      this.webAuthSpy.checkSession.lastCall.args[1](null, {
+        idTokenPayload: { sub: 'some-other-id' }
+      });
+    });
     it('do not return error if error === login_required', function(done) {
       this.auth0.getSSOData(function(err, result) {
         expect(err).to.be(null);
diff --git a/test/helper/ssodata.test.js b/test/helper/ssodata.test.js
index 67cbf37..2ff11c0 100644
--- a/test/helper/ssodata.test.js
+++ b/test/helper/ssodata.test.js
@@ -37,11 +37,12 @@ describe('helpers', function() {
           expect(key).to.be('auth0.ssodata');
           expect(JSON.parse(value)).to.be.eql({
             lastUsedUsername: 'username',
-            lastUsedConnection: 'connection'
+            lastUsedConnection: 'connection',
+            lastUsedSub: 'sub'
           });
           done();
         });
-        ssodata.set('connection', 'username');
+        ssodata.set('connection', 'username', 'sub');
       });
     });
   });
diff --git a/test/web-auth/web-auth.test.js b/test/web-auth/web-auth.test.js
index 8943990..0d63188 100644
--- a/test/web-auth/web-auth.test.js
+++ b/test/web-auth/web-auth.test.js
@@ -369,7 +369,8 @@ describe('auth0.WebAuth', function() {
               expect(ssodata.set.calledOnce).to.be.ok();
               expect(ssodata.set.firstCall.args).to.be.eql([
                 'lastUsedConnection',
-                'lastUsedUsername'
+                'lastUsedUsername',
+                undefined
               ]);
               expect(TransactionManager.prototype.getStoredTransaction.calledOnce).to.be.ok();
 
@@ -389,7 +390,8 @@ describe('auth0.WebAuth', function() {
               expect(ssodata.set.calledOnce).to.be.ok();
               expect(ssodata.set.firstCall.args).to.be.eql([
                 'lastUsedConnection',
-                'lastUsedUsername'
+                'lastUsedUsername',
+                'auth0|59fbe11937039b263a8b29a2'
               ]);
               expect(TransactionManager.prototype.getStoredTransaction.calledOnce).to.be.ok();
 
@@ -407,7 +409,8 @@ describe('auth0.WebAuth', function() {
               expect(ssodata.set.calledOnce).to.be.ok();
               expect(ssodata.set.firstCall.args).to.be.eql([
                 'lastUsedConnection',
-                'johnfoo@gmail.com'
+                'johnfoo@gmail.com',
+                'auth0|59fbe11937039b263a8b29a2'
               ]);
               expect(TransactionManager.prototype.getStoredTransaction.calledOnce).to.be.ok();
 
@@ -427,7 +430,8 @@ describe('auth0.WebAuth', function() {
               expect(ssodata.set.calledOnce).to.be.ok();
               expect(ssodata.set.firstCall.args).to.be.eql([
                 'lastUsedConnection',
-                'johnfoo@gmail.com'
+                'johnfoo@gmail.com',
+                'auth0|59fbe11937039b263a8b29a2'
               ]);
               expect(TransactionManager.prototype.getStoredTransaction.calledOnce).to.be.ok();