TTalvedo

Quick sign-in to your stands

The Sign in button on a project credential in Talvedo opens your stand in a new tab already signed in. Your app has to accept the link: here is how.

What the link looks like

The project lead sets a link template for each environment. The default one:

{url}#tv_login={login}&tv_password={password}&tv_token={token}

Talvedo puts the address of the credential or of the environment instead of {url} and the encoded values instead of {login}, {password} and {token}.

Values travel only after #, in the fragment. The browser never sends the fragment to the server, so the values do not get into server and proxy logs or the Referer header. Talvedo does not save a template that puts values before #.

What your app does

  1. At startup, read the fragment before the router does.
  2. Erase it from the address right away with history.replaceState, so that it does not stay in history or get copied with the link.
  3. Sign in with the values through your usual sign-in request and forget them: do not store or log them.
// At startup, before the router reads the address.
const params = new URLSearchParams(location.hash.slice(1));
const login = params.get('tv_login');
const password = params.get('tv_password');
const token = params.get('tv_token');

if (login || token) {
  // Erase the values from the address bar and history right away.
  history.replaceState(null, '', location.pathname + location.search);
  // Only outside production, and only to your own server.
  if (import.meta.env.MODE !== 'production') {
    await signIn({ login, password, token });
  }
}

If the app signs in through a third-party provider (Google, Keycloak, Auth0), add a sign-in by login and password or by token that exists only in development and test builds:

// A dev-only endpoint, if the app signs in through a third-party provider.
if (process.env.NODE_ENV !== 'production') {
  app.post('/dev/quick-login', async (req, res) => {
    const user = await users.findByLogin(req.body.login);
    if (!user || !(await user.checkPassword(req.body.password))) return res.status(401).end();
    return res.json({ session: await sessions.create(user) });
  });
}

Rules

  • Only development, test and staging environments. For an environment marked as production Talvedo builds such a link only while the project lead keeps quick sign-in to production on in the danger zone; a live product should not accept it.
  • Sign in only to your own server: never send the values anywhere else.
  • Do not log the values, do not put them in analytics or error reports.
  • The link with values stays in the browser history of the person who pressed Sign in until the app erases it. Whether to use quick sign-in is up to the team.