Log in "as a user" - but be careful. Admin usage

stuart4 · 2024-07-10T03:23:29.546Z

So after having a play around and getting a little frustrated at some password and magic link tokens I finally figured out a reliable was as an admin to login as a user with one click.

The issue I was finding was the token generated by bubble couldn’t be used in the backend workflows, however, I found a way.

Now be careful with this and apply ALLL the security and provisions you need to ensure this is secure!

You can apply the same logic to both password resets and magic links to suit your needs IF you needed a way capture the token and then use this in another flow.

Setup - you need to rather underreported “Bubble App Connector” plugin to connect to your own application - this is used so you can retrieve the token reuse it via a “return data from api” step.

image1662×367 18.6 KB

Navigate to backend workflows:

Create a new one, capture the user key, and set the response to json, and expose as a public api workflow (careful now), you’ll be securing it via a key.

image1552×1590 162 KB

.

Next select send magic link, enter the user email from the captured user data type and TICK just create link dont send email.

image1552×2400 193 KB

Next select “return data from api” and set it up like this, make sure you return the data as json safe or it wont work…

image1528×793 48.3 KB

That bits done… easy.

now go to the app settings area and select “API”

Create yourself an API token.

image1231×580 18.7 KB

Next go to the plugins area and find your newly installed “App Connector” or install it.

Configure what the plugin asks for - the app domain is your current bubble domain (or the custom domain, depending).

Add the API secret you created before.

and refresh the app meta data and select the newly created backend workflow, set them up to be action and with auth as API key

image2100×600 30.6 KB

image2117×698 26.3 KB

Now thats done you can use the actions in a workflow, so I created a grid of users and added a button with a workflow:

image1922×620 34.8 KB

You can access your newly created “app workflows” by searching for ‘run’ they they will pop up next to your apps name.

One thig to remember when passing the user is they API endpoint only accepts unique IDs

image1602×543 37.9 KB

Now what I am doing in the last step is to log on by opening an external website which is this site but with the URL for magic links that gets returned by the API.

image1603×852 63.3 KB

Also note there is a find and replace for quotes around the url that is returned (due to the json part).

If you just need the token you will have to split the url up and extract that part using split by ? last part, i think from memory)

(if you use the password recovery token, it wont be a url, but just a token, i think…)

Last time, but please be careful with this… whilst a powerful method for accessing user accounts, you should only use it where you absolutely need to.

stuart4 · 2024-07-10T06:32:39.750Z

@georgecollier you helped me with this method indirectly when you showed us all the mystery app connector plus a heap of other fun ways to pass data to your own api get a return value in the front end (or backend) and do more cools stuff. so thanks. Sharing is caring!

boston85719 · 2024-07-10T06:37:46.963Z

stuart4:

showed us all the mystery app connector plus a heap of other fun ways to pass data to your own api get a return value in the front end (or backend) and do more cools stuff.

Was this in a specific post on the forum or a video hosted publicly?

georgecollier · 2024-07-10T06:44:28.850Z

This is very helpful - I’ve never been able to work out a way to do this but your method makes sense!

boston85719:

Was this in a specific post on the forum or a video hosted publicly?

How To Return Data From Backend API Workflows (no manual API connector) Tips

TLDR: calling backend workflow from API connector is unreasonably tedious app connector auto-sets up and syncs fields result/returned data from backend workflow can be used in following front-end steps Returning data from backend workflow in front-end without manually setting up API connector calls I have a lot of feelings today, as I’ve learned something that would’ve saved me hours of time had I known earlier, and it feels like something that only a handful of people know about (based on th…

stuart4 · 2024-07-10T23:30:05.380Z

Yea, a fair bit of trail and error but this is really handy - the app connector is a hidden gem…
so nice to have backend workflows responses easily accessible in the front end. When I read your post on this I knew it would solve the token issue. There are quite a few post on the forum about reset tokens etc, so this method should help those who find it.

georgecollier · 2024-07-27T17:31:26.542Z

Just as a word of warning, this is not secure if you follow the methodology of the original post exactly, as it will allow any logged in user to generate a login token for any other user provided they know the other user’s unique ID.

Explanation: To call this workflow from the backend, the workflow must be public. You may think that ‘this workflow can be run without authentication’ being unchecked would protect it. This is not the case. Any logged in user is ‘authenticated’. Therefore, any logged in user can call this backend workflow with a User’s ID and get a magic login link into their account.

Solution:

To implement this securely, you need to verify that the request came from a permitted user (a user that should be allowed to do this e.g an admin user) There are multiple ways to do this, but I’ll share a simple way below. Roughly speaking, we’ll generate a temporary permission token in the front-end for the Current User after checking they’re allowed to do this, and in the backend, we’ll check that the permission token is valid by searching to check if there is a user with this permission token (yes, you can also add another user parameter if you really want to check that both the permission token exists and it belongs to the User making the request but I’m keeping this example solution simple).

Add a permissionToken parameter to the backend workflow

CleanShot 2024-07-28 at 01.22.52@2x1590×1262 164 KB
Add a permissionToken text field to the User data type
Terminate the backend workflow when Do a search for Users with permissionToken = permissionToken (the one received by the backend workflow):first item is empty (i.e, there are no users with this permission token). I’ve also added the same condition on the other two actions (not shown in the screenshot) purely because I don’t trust Bubble obeying order of actions for an action like this!
In the place you want to trigger the run as action, have a condition on the workflow that checks the user is authorised to do this (e.g Current User’s isAdmin is yes):

CleanShot 2024-07-28 at 01.24.40@2x1774×1086 65.6 KB
Inside the workflow, generate a permission token using Calculate RandomString. It is not an issue that this is a client-side action as it doesn’t matter that the user can see this, as they’re already authorised to do this action.
Pass the permission token to the backend workflow.
Once the login link is returned from the backend workflow, set the Current User’s permissionToken to be empty again.

Again, this assumes you have privacy rules on your User data type to stop users finding other user’s permission tokens, but if you don’t have those set up then you definitely shouldn’t be playing around with this!

stuart4 · 2024-07-28T00:51:38.470Z

Thanks for the added security details @georgecollier , I actually had reservations posting this in the first place to be honest. In my case I don’t let anyone run this who isn’t me (the dev). appreciate your input.

georgecollier · 2024-07-28T01:16:52.275Z

stuart4:

In my case I don’t let anyone run this who isn’t me (the dev).

Of course - just wanted to make sure you knew that your set up in the original post would allow anyone to run it.

stuart4 · 2024-07-28T01:59:06.830Z

you are a gentleman and a scholar @georgecollier