Juice-shop: Feature: add auto-save for solved challenges.

[thefishermanhacker]

Speaking of auto things, aka #307, its can be good idea to add auto-save for challenges.
Scenario I think of is to do auto-save right after challenge solved.

[bkimminich]

@thefishermanhacker For that many brilliant feature ideas (and bug reports) you deserve a couple laptop stickers! Shoot me an email or Twitter-DM with your address and I'll send them on their way!

[thefishermanhacker]

Thanks ;), I added you to twitter but cannot dm.
My twitter is @sasi2103

[bkimminich]

Could be implemented similarly to #313 via websocket event listening.

[thefishermanhacker]

Nice implementation!

On May 7, 2017 22:45, "Björn Kimminich" [e-mail] wrote:

Could be implemented similarly to #313
https://github.com/bkimminich/juice-shop/pull/313 via websocket event
listening.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/bkimminich/juice-shop/issues/309#issuecomment-299729614,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AC9m-pT3qFc3VuxZeBJNshba5FcQcWLVks5r3h9EgaJpZM4NMh6h
.

[bkimminich]

Argh, damn this one comes with a problem I didn't think about. Consider this use case:

Expected Behavior

1. You solve 10 challenges which is all stored in your continueCode cookie ✔️
2. Your app crashes. You restart. ✔️
3. You go to the Score Board and hit _Restore Progress_ ✔️
4. Your continueCode cookie is used to restore the 10 challenges ✔️

Actual Behavior

1. You solve 10 challenges which is all stored in your continueCode cookie ✔️
2. Your app crashes. You restart. ✔️
3. You go to the Score Board. This solves the corrsponding challenge and overwrites your continueCode cookie ❌
4. You hit _Restore Progress_ ✔️
5. Your continueCode cookie is used to "restore" only the solved Score Board challenge from after the restart! ❌

[bkimminich]

Reverted @J12934's implementation with a0caa2c353a059f4834b3735a19d925d424b94c6. I honestly have no idea how to address this behavior without some crazy workarounds or assumptions, and those would have issues of their own:

Example

❔ We could only overwrite the continue code...

• ...after a restart and
• ...after the Restore Progress-button has been clicked

❌ If the user does not restore progress and solves more/other challenges than when the progress was last auto-saved, his new progress would never be saved!

So, it's probably best to keep the Save/Restore Progress functionality a manual user action, so at least they know what they get.

[bkimminich]

@thefishermanhacker, @J12934 and everyone else taking an interest: _Please post any ideas how to get around these issues here as a comment!_

[J12934]

Umm yeah i haven't thought about this either 😅

Funnily the Use Case above would work with the implementation, because of a minor detail in the way the scoreboard is written:

1. You solve 10 challenges which is all stored in your continueCode cookie ✔️
2. Your app crashes. You restart. ✔️
3. You go to the Score Board. ✔️
4. The correct cookie is saved to the scoreboard scope. ✔️
5. Visiting the scoreboard solves the corresponding challenge and overwrites your continueCode cookie but not the value in the scope ❌
6. You hit Restore Progress ✔️
7. The initial continue code is used to restore all challenges ✔️

This minor detail unfortunately doesn't solve the entire problem.
It will not work when the user is solving a challenge other then the scoreboard challenge...

[bkimminich]

... or if the user visits the Score Board, goes somewhere else, comes back to the Score Board and then hits _Restore_... 😕

[bkimminich]

While discussing the issue with @wurstbrot, some possible alternative solution came up. Please provide feedback if you'd prefer this over manual progress saving like it is today:

• Auto save into cookie continueCode on every challenge solved
• When the backend server is started, put some special header (e.g. X-Server-Started) into _only the first_ response the server ever sends send a WebSocket notification server started _only once_ to the client
• When the client sees this headernotification _and_ there is a continueCode cookie present, show a modal overlaynotification (similar to those upon solving a challenge, just in different color) asking "Do you want to restore your previous hacking progress?"
• Remove save/restore buttons from Score Board as they are now obsolete or even potentially dangerous interference

[thefishermanhacker]

sounds good, but how about putting auto save in general?
I mean after X mins, lets say 5 mins, the system will do auto save.
you can add check box for autosave or not.

On May 13, 2017 10:28, "Björn Kimminich" [e-mail] wrote:

While discussing the issue with @wurstbrot https://github.com/wurstbrot,
some possible alternative solution came up. Please provide feedback if
you'd prefer this over manual progress saving like it is today:

• Auto save into cookie continueCode on every challenge solved
• When the backend server is started, put some special header (e.g.
  X-Server-Started) into only the first response the server ever sends
• When the client sees this header and there is a continueCode cookie
  present, show a modal overlay asking "Do you want to restore your previous
  hacking progress?"
• Remove save/restore buttons from Score Board as they are now obsolete
  or even potentially dangerous interference

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/bkimminich/juice-shop/issues/309#issuecomment-301231436,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AC9m-lLwusVdqOGFNiHU2iLbeteZ9RZBks5r5VuhgaJpZM4NMh6h
.

[bkimminich]

I think I have found a proper way to do this w/o additional workaround-code: A new websocket event server started that is only sent once and will make the client show a notification similar to those on challenge solved events. Just in different color, See https://github.com/bkimminich/juice-shop/issues/309#issuecomment-301231436.

Should _not_ be a modal overlay, as this could interfere with the e2e tests. An ignored notification would not harm them on the other hand.

[lock[bot]]

This thread has been automatically locked because it has not had recent activity after it was closed. :lock: Please open a new issue for regressions or related bugs.