Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Don't store JWT token in an SSR environment #9848

Open
wants to merge 1 commit into
base: v1.x
Choose a base branch
from

Conversation

devcshort
Copy link

@devcshort devcshort commented Oct 28, 2024

What - This change makes it so that JWT doesn't get stored on the Medusa client when in an SSR environment.

Why - Currently when the Medusa client is used in an SSR environment, the last logged in user's JWT gets stored on the Medusa client. This causes customer information to be leaked when it shouldn't be.

How - To keep things DRY, I added a typeof check to the jwt-token-manager that checks if the window is undefined. If it's undefined, I'm simply just returning as I don't believe any further action is needed.

This fixes the issue referenced here #6889

Copy link

changeset-bot bot commented Oct 28, 2024

⚠️ No Changeset found

Latest commit: 88833f2

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

Copy link

vercel bot commented Oct 28, 2024

@devcshort is attempting to deploy a commit to the medusajs Team on Vercel.

A member of the Team first needs to authorize it.

@u11d-bartlomiej-galezowski

@sradevski @olivermrbl @shahednasser can we ask for your review? This fix is really urgent for us.

@thetutlage
Copy link
Contributor

Looks fine to me. I will let @olivermrbl and @sradevski look into it once and especially the failing CI tests

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants