feat: add support for anonymous sessions - #156
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| try: | ||
| async with self._get_http_client() as client: | ||
| await client.post(f"{base_url}/anonymous/logout", json=body) | ||
| except httpx.HTTPError: |
yogeshchoudhary147
left a comment
yogeshchoudhary147
left a comment
There was a problem hiding this comment.
Reviewed against both the implementation and the SDK requirements doc. Inline comments below cover spec deviations, confirmed bugs, and test gaps. Two earlier findings have been retracted: the _normalize_url str.replace concern (false positive for real-world domain inputs) and the claim that httpx.HTTPError catches 4xx/5xx responses (it does not — those are only raised via raise_for_status(), which logout() never calls).
| # Anonymous Session Error Classes | ||
| # ============================================================================= | ||
|
|
||
| class AnonymousApiError(Auth0Error): |
There was a problem hiding this comment.
Spec deviation — error class names diverge from the requirements doc.
The SDK requirements doc specifies:
class AnonymousSessionError(Auth0Error): ...
class AnonymousSessionCreateError(AnonymousSessionError): ...
class AnonymousSessionTokenExpiredError(AnonymousSessionError): ...This implementation ships AnonymousApiError, AnonymousCreateError, AnonymousTokenError, etc.
If the JS SDKs use the spec names, Python's public error surface will be inconsistent across SDKs. Any shared developer-facing error-handling documentation will show different class names per platform. If the rename is intentional, the spec should be updated to reflect it.
| super().__init__(code, message, cause) | ||
|
|
||
|
|
||
| class AnonymousLogoutError(AnonymousApiError): |
There was a problem hiding this comment.
AnonymousLogoutError is dead code — it can never be raised.
_map_anonymous_error() maps operation == "logout" to this class, but logout() never calls _map_anonymous_error(). The except httpx.HTTPError in logout() catches only transport-level failures; non-2xx HTTP responses are silently ignored because the response object is never inspected at all. The only exception logout() can raise to a caller is ConfigurationError from _require_store().
Either:
logout()should check the response status, call_map_anonymous_error(), and re-raise on non-2xx (while still clearing local state), orAnonymousLogoutErrorand thelogoutbranch in_map_anonymous_error()should be removed.
|
|
||
| def __init__( | ||
| self, | ||
| domain, |
There was a problem hiding this comment.
domain parameter is untyped.
Every sibling client (MfaClient, MyAccountClient) types this as Union[str, Callable]. This is the only one that leaves it bare. Inconsistency will surface under type checkers and makes the parameter contract invisible to IDE users.
| raise AnonymousCreateError( | ||
| f"metadata key '{key}' is not allowed", code="invalid_metadata" | ||
| ) | ||
| if not isinstance(value, str): |
There was a problem hiding this comment.
Metadata value restriction is narrower than the spec and should be confirmed against the actual API.
The requirements doc defines metadata as Record<string, unknown> (any JSON value). This implementation rejects non-string values client-side. If the Auth0 API actually accepts non-string values, this check incorrectly blocks valid callers. If the API only accepts strings in practice, the spec is wrong and needs updating.
Consequently, AnonymousSessionContext.metadata is typed Optional[dict[str, Any]] (any value), while creation only permits dict[str, str]. The type annotation does not express the constraint, so the model's round-trip deserialization of a stored context containing an integer value would silently succeed at the Pydantic level.
|
|
||
| now = int(time.time()) | ||
| new_context = AnonymousSessionContext( | ||
| session_token=token_response.session_token or context.session_token, |
There was a problem hiding this comment.
or idiom silently swallows empty strings for Optional[str] fields.
session_token=token_response.session_token or context.session_token,
sub=token_response.sub or context.sub,
session_id=token_response.session_id or context.session_id,"" or context.X falls back to the stale context value, so if the API ever returns an empty string for any of these, the old value is silently persisted. Prefer explicit None-checks:
session_token=token_response.session_token if token_response.session_token is not None else context.session_token,This is consistent with how session_expires_in is handled two lines below.
| "Failed to parse anonymous introspection response" | ||
| ) from e | ||
|
|
||
| async def logout(self, store_options: Optional[dict[str, Any]] = None) -> None: |
There was a problem hiding this comment.
logout() never raises AnonymousLogoutError — see the comment on error/__init__.py:392.
Additionally, there is no test covering the branch at line ~693 where _decrypt_context raises _AnonymousSessionExpired (sets context = None and skips the server call). That path clears local state correctly but is untested.
| access_token: str | ||
| token_type: str = "Bearer" | ||
| expires_in: int | ||
| session_token: Optional[str] = None |
There was a problem hiding this comment.
session_token is Optional here but effectively required on the create path.
_create_session_at() validates the response with this model and then immediately does:
if not token_response.session_token:
raise AnonymousCreateError("Anonymous token response missing required fields")The Optional typing exists to accommodate the re-mint path (where the server may not return a new session token). Consider a separate narrow model for the create response, or at minimum a Pydantic validator that enforces presence, so the constraint is expressed in the type rather than in a manual post-validation check.
| domain=origin_domain, | ||
| redirect_uri=auth_params.get("redirect_uri"), | ||
| organization=resolved_org, | ||
| session_token=anonymous_session_token, |
There was a problem hiding this comment.
Question: should complete_interactive_login() promote session_token from TransactionData into StateStore?
The auth0-server-js section of the requirements doc says:
completeInteractiveLogin()— on callback, read the session token back from TransactionStore and promote it into StateStore as part of the authenticated session.
The Python section does not mention this step. The session token is saved into TransactionData here but nothing reads it back during the callback. If auth0-fastapi (GA) will need to reconstruct the anonymous session after login, this plumbing would need to exist in auth0-server-python first. Please confirm the omission is intentional for EA scope.
| # ============================================================================= | ||
|
|
||
|
|
||
| class _OneSlotStore: |
There was a problem hiding this comment.
_OneSlotStore is duplicated — identical class exists as OneSlotStore in test_anonymous_client.py:41.
The explanatory comment about why AsyncMock is insufficient (identifier-as-salt, not location key) exists in both files. Moving it to conftest.py as a shared fixture would eliminate the duplication and keep the explanation in one place.
| SECRET = "test-secret-long-enough-for-encryption" | ||
|
|
||
|
|
||
| class OneSlotStore: |
There was a problem hiding this comment.
Two test coverage gaps in introspect():
- No test for what happens when the stored context is corrupted (invalid JWE) —
introspect()should raiseAnonymousIntrospectError, but this branch is untested. Compare to the equivalent test inTestGetToken.test_corrupted_stored_token_triggers_silent_new_session. - The
TestLogoutclass has no test for thecontext = Nonebranch (corrupted/missing context skips the server call but still clears local state).
3 participants
Changes
Added
ServerClient.anonymousfor pre-login anonymous sessions:create_session,get_token,introspect, andlogout. Gives a visitor a persistentanon@<uuid>identity plus a short-lived access token before they authenticate, with up to 1 KB of metadata attached at
creation. Framework-agnostic RWA core — mounts no routes and sets no cookies.
identifier, isolated from the authenticated
_a0_sessionstore.AnonymousSessionneverexposes the raw session token to the caller.
get_token: fresh cached access token is returned;expired access token is re-minted with the session token; an expired or invalid session
token silently creates a brand-new session, once, surfaced via
AnonymousSession.is_new. Metadata is lost andsubchanges on that silent re-mint — thisnever raises, since an anonymous pre-login session carries no authorization.
session_tokenintostart_interactive_login()automatically whena session is active, sourced only from the SDK's own encrypted store and bound into
TransactionDataunder the existingstatebinding.AnonymousSession,AnonymousTokenResponse,AnonymousSessionContext,AnonymousSessionIntrospection) and atyped error hierarchy under
AnonymousApiError, including five config subclasses(
AnonymousFeatureNotEnabledError,AnonymousClientNotEnabledError,AnonymousClientNotSupportedError,AnonymousResourceServerError,AnonymousScopeError)(
__proto__,constructor,prototype) and enforces a 1 KB (UTF-8 JSON) size cap.Testing
As part of manual testing following flows have been completed:
Happy Path
POST /anonymous/sessionmints ananon@<uuid>identity; returnssession_token(opaque JWE,ANONYMOUS_SESSION_prefix) +access_token(RS256 JWS, audience-bound).GET /anonymous/sessionwalks the renewal ladder: cached → re-mint viasession_token→ silent new session.GET /anonymous/login-urlconfirmssession_tokenis auto-injected into/authorize(session_token_injected: true), no call-site change.POST /anonymous/logoutbest-effort calls/anonymous/logout, then always clears local store; post-logoutGETreturnsAnonymousTokenError(fail-closed). Issued access tokens self-expire (notrevoked).
Negative / Fail-Closed
anonymous_resource_server_erroranonymous_scope_errorinvalid_metadata(local, pre-network)__proto__invalid_metadatametadata_too_largeAnonymousTokenErrorChecklist