ArrowDB not returning correct session id in usersLogin API callback

Question

JIRA ticket AC-3349 opened. I'm posting the question here in order to help others who might be encountering the issue. Please follow the ticket if you have the same issue.

Details: This issue has just started happening today (starting at 1.30PM EST or so) - things were working just fine before that. If you use the ArrowDB Node SDK usersLogin to sign in as a non-admin user, the session id returned in the meta object is the session id of the admin user instead! One can confirm that by using the ArrowDB Node SDK usersShowMe and passing the session id, which returns the user object for the admin instead of the originally logged in user. Something has clearly changed in the last hour or two because these APIs were working correctly prior to that. I have tried this with two different ArrowDB instances and the issue is the same on both. Hence the issue isn't with the specific ArrowDB instance but elsewhere in ArrowDB session management on the Appcelerator platform.

Answer 1

Apparently this happens only in the following scenario:

First, sign in as User A (say) and store the session id somewhere. Next, in the Node.js code, create a new instance of ArrowDB and then set the sessionCookieString property using the previously stored session id. Next, in the same code block, sign in as User B (say, which in my case was an admin account) using the usersLogin method. Once signed in, apparently the previously stored session id now "belongs to" User B, which I think is a bug. I'd assume that the usersLogin method would issue a new session id for the User B and leave the previously generated session id for User A alone. But that's not what happens. The previous session id for User A is reassigned to User B, which I believe is a bug in ArrowDB SDK.

As a workaround, one needs to create a new instance of ArrowDB if one wishes to sign in as a different user (typically admin account) AFTER one has already set the sessionCookieString for an existing instance otherwise the previous session id gets reassigned.