Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Logout functionality not working correctly in qnabot-on-aws solution #747

Closed
1 task
demismirnov opened this issue Jul 9, 2024 · 2 comments
Closed
1 task

Comments

@demismirnov
Copy link

demismirnov commented Jul 9, 2024

Describe the bug
We have deployed the "qnabot-on-aws" solution and are facing a critical issue with the logout functionality. When a user logs out of the application, they are redirected to the Cognito login page. From there, they can log back in as an admin user without providing any credentials, simply by clicking the "Sign In as Admin" button. This indicates that the logout process is not effectively terminating the user's session, posing a significant security risk.

To Reproduce

  1. Deploy the "qnabot-on-aws" solution.
  2. Log in to the application as an admin user.
  3. Click on the logout button.
  4. On the Cognito login page, click the "Sign In as Admin" button.
  5. Observe that the user is logged back in as an admin without providing any credentials.

Expected behavior
When a user logs out of the application, their session should be terminated, and they should be required to provide their credentials to log back in.

Please complete the following information about the solution:

  • [v6.0.1] Version: [e.g. v0.0.1]
  • [ us-east-1] Region: [e.g. us-east-1]
  • [N] Was the solution modified from the version published on this repository?
  • If the answer to the previous question was yes, are the changes available on GitHub?
  • [Y] Have you checked your service quotas for the services this solution uses?
  • [N] Were there any errors in the CloudWatch Logs?
@demismirnov demismirnov added the bug label Jul 9, 2024
@dougtoppin
Copy link

@demismirnov Thanks for your report, we will investigate and get back to you

@michaelin-96
Copy link
Member

Hi @demismirnov, this issue should be addressed in the v6.0.2 release. Closing task out.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

5 participants