You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
If we sign a message for Anclap once with account A, we switch to account B also signing the message and then try going back to A, we find that the offramp will not start for A with a memo error replied from the backend.
Why this is happening
After we moved to http-only cookie authentication, the backend sets it upon response of a successful login. This means that if there was an auth cookie before, it will be overridden.
As we also save a storage element that the UI uses to recognize that the cookie was set, and handle the expiration, when we switch back to account A on the scenario above, we end up sending the wrong cookie to the backed (that of account B).
Potential solutions
The quickest solution is to remove the storage of the old address entry after a new address has just signed. But this will mean that switching back to an account will require signing again.
If we want to avoid signing again, another option is to modify the name of the auth cookie such that it is unique for each address.
We can then send all of them (which will be done automatically) and the backend needs to filter which one, if any, is valid.
The text was updated successfully, but these errors were encountered:
@pendulum-chain/product This issue is not necessarily something urgent, but needs to be fixed soon. I don't think it is so uncommon that a user off-ramps from 2 wallets many times.
Description and steps to replicate:
If we sign a message for Anclap once with account A, we switch to account B also signing the message and then try going back to A, we find that the offramp will not start for A with a memo error replied from the backend.
Why this is happening
After we moved to http-only cookie authentication, the backend sets it upon response of a successful login. This means that if there was an auth cookie before, it will be overridden.
As we also save a storage element that the UI uses to recognize that the cookie was set, and handle the expiration, when we switch back to account A on the scenario above, we end up sending the wrong cookie to the backed (that of account B).
Potential solutions
We can then send all of them (which will be done automatically) and the backend needs to filter which one, if any, is valid.
The text was updated successfully, but these errors were encountered: