[WOOKIE-384] persist parameter of oAuth feature not user-isolated

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.13.0
• Component/s: Feature Management
• Environment: Windows 7, Chrome
• Assignee: Unassigned
• Reporter: Matthias Niederhausen
• Created: 08/Oct/12 08:52
• Updated: 08/Nov/12 10:12
• Resolved: 08/Nov/12 10:12

Description

When I use the "persist" parameter of the oAuth feature (which is the default), every other user will automatically use my token after I have approved access.
This results in a severe security issue, e.g., my google contact list being shown to someone else.
Using "false" for the parameter value, I have to re-authenticate every try (which is okay).

The behaviour for "true" should instead be to cache the token for every individual user (i.e., widget instance).