Skip to content

Conversation

@vdonato
Copy link
Collaborator

@vdonato vdonato commented Nov 18, 2022

📚 Context

There's currently a race condition that appears when using an external auth token passed to the
streamlit web client. The race is between the auth token actually making it to the iframed streamlit
app before it attempts to establish a websocket connection. What generally happens is that the first
attempt to establish the websocket connection is done without having received the token, which
results in a failed connection attempt. The next retry about 500ms later then succeeds (most
of the time, although the asynchronous nature of all of this makes it hard to guarantee when the
token is received), but both the extra round-trip and notable startup delay are annoying.

This PR fixes this problem by adding a new field to the /st-allowed-message-origins response body.
The useExternalAuthToken field (which for now will always be set to False in the pure open source
world) is used by the client to decide whether to wait for an auth token to be received from the parent
frame before attempting to establish a websocket connection to the Streamlit server.

If useExternalAuthToken is False, the client immediately attempts to establish a websocket
connection. Otherwise, it waits until a promise resolves to the auth token before proceeding.

  • What kind of change does this PR introduce?

    • Bugfix
    • Feature

🧪 Testing Done

  • Added/Updated unit tests

@vdonato vdonato force-pushed the external-auth-token-race branch from b9c6e70 to f431fb6 Compare November 18, 2022 09:20
@vdonato vdonato marked this pull request as ready for review November 18, 2022 23:59
@vdonato vdonato force-pushed the external-auth-token-race branch from f431fb6 to f8023ad Compare November 19, 2022 00:01
@vdonato vdonato added the security-assessment-completed Security assessment has been completed for PR label Nov 19, 2022
@streamlit streamlit deleted a comment from sfc-gh-vdonato Nov 19, 2022
@vdonato vdonato force-pushed the external-auth-token-race branch 3 times, most recently from 369c5cb to 6b3b257 Compare November 29, 2022 01:29
@lukasmasuch lukasmasuch requested a review from tconkling December 1, 2022 19:18
Copy link
Contributor

@tconkling tconkling left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this looks good, but to be honest the complexity of this host-communication machinery makes it fairly impenetrable to my wee brain.

I wonder if withHostCommunication just shouldn't be a React thing at all.

Comment on lines 95 to 121
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not a criticism of your PR, but this whole class is sooooo hairy. It feels essentially write-only at this point.

I feel like we should prioritize a withHostCommunication refactor in the near-near future. (Should it even be a React component?)

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, agreed. I'd support seeing if we can get this made an official Q1 goal given that this code is changing far more frequently than I would have expected it to when I first noticed it was pretty hairy

@vdonato vdonato force-pushed the external-auth-token-race branch from 6b3b257 to 23648c3 Compare December 3, 2022 00:27
Copy link
Collaborator

@kmcgrady kmcgrady left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I left some comments and questions just to solidify my understanding.

@vdonato vdonato merged commit 9eb23c6 into streamlit:develop Dec 9, 2022
@vdonato vdonato deleted the external-auth-token-race branch December 9, 2022 23:26
tconkling added a commit that referenced this pull request Dec 20, 2022
* develop:
  Change workers balancing logic for e2e tests to always cover all specs (#5865)
  Up version to 1.16.0 (#5852)
  Stop installing pip-tools (#5854)
  Add eslint no relative import paths plugin to pre commit hooks (#5839)
  Docs: move note to `experimental_allow_widgets` param description (#5843)
  Update element docstrings for colored text support (#5831)
  Add remark-directive plugin (Support for colored text in markdown) (#5774)
  Teach WebsocketConnection how to wait on an external auth token (#5728)
  Turn on streamlit theme for altair and plotly (#5796)
  Fix markdown headers spacing (#5829)
  Update error message and docstring in st.map (#5792)
  Remove unnecessarily methods from DeltaGenerator (#5824)
  Resolve vega-tooltip to later version (#5825)
  Easter Egg (#5817)
  Update Exception Layout to avoid overflow (#5700)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

security-assessment-completed Security assessment has been completed for PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants