| FazBrowse GitHub Viewer | Trending | | Home |
| Tools: [Download Repo ZIP] [Original HTTPS Page] |
Sorry, something went wrong.
When social signup (Google/GitHub) opens a popup for authentication, the Callback component failed because it couldn't find OAuth state in sessionStorage (state was never stored for popup-based flows). This adds popup detection to the Callback component: when running inside a popup (window.opener exists), it sends OAuth parameters back to the parent window via postMessage instead of attempting sessionStorage-based routing. The parent's messageHandler receives the code and continues the flow. Also prevents a race condition where both the postMessage handler and the popup URL monitor could process the same callback, causing duplicate requests with an invalid challenge token. Fixes thunder-id/thunderid#2368
|
Warning Rate limit exceeded@DonOmalVindula has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 59 seconds before requesting another review. To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR. We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 010e24f4-1813-47ab-82e7-6c90bcd1c71c 📥 CommitsReviewing files that changed from the base of the PR and between 2e3e9c4 and 92396a1. 📒 Files selected for processing (3)
WalkthroughThis PR adds popup-aware OAuth callback handling to React and Vue components. When an OAuth callback occurs in a popup window, parameters are now forwarded to the parent window via postMessage instead of being processed locally, with state-flag management to prevent reprocessing. ChangesPopup-Based OAuth Callback Flow
Sequence DiagramsequenceDiagram
participant User
participant SignUp as SignUp Component
participant Popup as OAuth Popup
participant OAuthProvider as OAuth Provider
participant CallbackComp as Callback Component
User->>SignUp: Click social login button
SignUp->>Popup: window.open(callbackUrl)
User->>OAuthProvider: Authenticate
OAuthProvider->>CallbackComp: Redirect with code + state
Note over CallbackComp: window.opener exists
CallbackComp->>SignUp: postMessage({code, state, ...})
Note over SignUp: Receive message in handler<br/>Set hasProcessedCallback = true<br/>Process OAuth params
SignUp->>SignUp: onSubmit / onComplete
SignUp->>User: Complete signup flow
Estimated Code Review Effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem🚥 Pre-merge checks | ✅ 5 ✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches 🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. ❤️ ShareComment @coderabbitai help to get the list of available commands and usage tips. |
Sorry, something went wrong.
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)packages/react/src/components/presentation/auth/SignUp/v2/BaseSignUp.tsx (1)561-596: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win
Race condition remains: messageHandler lacks a hasProcessedCallback guard before calling onSubmit.
The new hasProcessedCallback = true assignment (line 564) prevents the popupMonitor from duplicating the request when the message event fires first. However, the reverse race is unguarded:
- popupMonitor fires while the popup is already at the callback URL (same-origin, so popup.location.href is readable) but before the postMessage has been processed.
- Interval sets hasProcessedCallback = true and enters await onSubmit(payload), yielding to the event loop.
- The queued message event fires next; messageHandler sees code && state, skips no check, and issues a second onSubmit call with an already-consumed challengeToken.
The window where this race can occur is bounded by the time between the popup navigating to the callback URL and the parent processing the postMessage — roughly the component mount latency (~50–200 ms) — against the 1-second interval tick, giving an estimated hit rate of ~5–20% of flows.
🛡️ Proposed fix — add the reciprocal guard to messageHandler🤖 Prompt for AI Agentsconst {code, state} = event.data; if (code && state) { + if (hasProcessedCallback) { + return; + } hasProcessedCallback = true; const payload: EmbeddedFlowExecuteRequestPayload = {Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/react/src/components/presentation/auth/SignUp/v2/BaseSignUp.tsx` around lines 561 - 596, messageHandler currently processes the postMessage callback without checking hasProcessedCallback, causing a potential double-call to onSubmit when popupMonitor has already started handling the same callback; add a guard at the start of messageHandler to return early if hasProcessedCallback is true (the same flag set by popupMonitor), and only set hasProcessedCallback = true immediately before invoking onSubmit in messageHandler (mirroring popupMonitor) so both paths coordinate and prevent duplicate onSubmit(payload) calls (refer to messageHandler, popupMonitor, hasProcessedCallback, and onSubmit).
packages/react/src/components/presentation/auth/SignUp/v2/BaseSignUp.tsx (1)🤖 Prompt for all review comments with AI agents561-596: ⚡ Quick win
OAuth error responses from the popup are silently dropped by messageHandler.
When the IDP returns an error (e.g., user denies the consent), the Callback component forwards { code: null, state: null, error: 'access_denied', errorDescription: '…' } via postMessage. The messageHandler only acts when code && state — so the error payload is ignored entirely. The fallback popupMonitor interval does detect error= in the popup URL and closes the popup (line ~630–635), but it calls only logger.error with no handleError/onError propagation, leaving the user with no feedback.
Consider extending the messageHandler to handle the error case:
✨ Suggested extension to handle error postMessages🤖 Prompt for AI Agentsconst {code, state} = event.data; + if (event.data.error) { + handleError(new Error(event.data.errorDescription || event.data.error)); + onError?.(new Error(event.data.errorDescription || event.data.error)); + popup.close(); + cleanup(); + return; + } if (code && state) {Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/react/src/components/presentation/auth/SignUp/v2/BaseSignUp.tsx` around lines 561 - 596, The message handler currently only processes messages when both code and state are present, so error payloads are ignored; update the block that reads const {code, state} = event.data to also detect error and errorDescription (e.g., const {error, errorDescription} = event.data) and in that branch call handleError(new Error(errorDescription || error)), invoke onError?.(new Error(...)), then ensure popup.close() and cleanup() are called (similar to the success/catch paths). Also extend the popupMonitor fallback branch that detects error= in the popup URL to call handleError/onError (with a constructed Error including the error query string) before logging and closing the popup so error events are propagated consistently.
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@packages/react/src/components/presentation/auth/SignUp/v2/BaseSignUp.tsx`:
- Around line 561-596: messageHandler currently processes the postMessage
callback without checking hasProcessedCallback, causing a potential double-call
to onSubmit when popupMonitor has already started handling the same callback;
add a guard at the start of messageHandler to return early if
hasProcessedCallback is true (the same flag set by popupMonitor), and only set
hasProcessedCallback = true immediately before invoking onSubmit in
messageHandler (mirroring popupMonitor) so both paths coordinate and prevent
duplicate onSubmit(payload) calls (refer to messageHandler, popupMonitor,
hasProcessedCallback, and onSubmit).
---
Nitpick comments:
In `@packages/react/src/components/presentation/auth/SignUp/v2/BaseSignUp.tsx`:
- Around line 561-596: The message handler currently only processes messages
when both code and state are present, so error payloads are ignored; update the
block that reads const {code, state} = event.data to also detect error and
errorDescription (e.g., const {error, errorDescription} = event.data) and in
that branch call handleError(new Error(errorDescription || error)), invoke
onError?.(new Error(...)), then ensure popup.close() and cleanup() are called
(similar to the success/catch paths). Also extend the popupMonitor fallback
branch that detects error= in the popup URL to call handleError/onError (with a
constructed Error including the error query string) before logging and closing
the popup so error events are propagated consistently.
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 5813aa9c-710f-4296-bfb6-25c50e0d3f45
📥 CommitsReviewing files that changed from the base of the PR and between faf4ab0 and 2e3e9c4.
📒 Files selected for processing (3)
Sorry, something went wrong.
🦋 Changeset detectedThe changes in this PR will be included in the next version bump. Not sure what this means? Click here to learn what changesets are. |
Sorry, something went wrong.
| Back | FazBrowse Home | New Git URL |
Summary
Context
The embedded SignUp component uses a popup window for social auth flows. After the user authenticates with Google/GitHub, the IDP redirects the popup to /callback?code=...&state=.... Previously, the Callback component would throw "Missing OAuth state parameter" or "Invalid OAuth state" because initiateOAuthRedirect (which stores state in sessionStorage) is never called for popup-based flows.
Test plan
Fixes thunder-id/thunderid#2368
Summary by CodeRabbit
Release Notes