User sessions are cached in memory forever

[eatyourgreens]

auth.checkCurrent() returns a cached _currentUserPromise here, if it's already been set on page load.

panoptes-javascript-client/lib/auth.js

Lines 169 to 186 in bbda9c2

	checkCurrent: function() {
	if (!this._currentUserPromise) {
	console.log('Checking current user');
	this.update({
	_currentUserPromise: this._getBearerToken()
	.then(function() {
	return this._getSession();
	}.bind(this))
	.catch(function() {
	// Nobody's signed in. This isn't an error.
	console.info('No current user');
	return null;
	}),
	});
	}
	return this._currentUserPromise;
	},

The problem with this is that the stored user session can't be reset by logging out in another tab. This code will never check the Panoptes API for a stale user session, as long as this._currentUserPromise is defined.

To test this out, run auth.checkCurrent() in two tabs, re-running it on visibility change, then log out in one of the tabs. The other tab will still return a Panoptes user from auth.checkCurrent(), even though its session cookie is no longer valid.

[eatyourgreens]

See also zooniverse/front-end-monorepo#4892