Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Invalidation / expiration of ticket in local storage not properly handled on return to Content App #2523

Open
AFaust opened this issue May 24, 2022 · 0 comments
Labels

Comments

@AFaust
Copy link

AFaust commented May 24, 2022

Describe the bug
Content Application does not handle background invalidation / expiration of tickets properly, causing Browser login popup to show when encountering HTTP 401 responses. When the login popup is filled and submitted with correct credentials, the popup continues to reappear. When the login popup is cancelled, the user is redirected to the ACA login page.

Environment

  • ACA version: 2.9.0
  • ACS version: 7.2

To Reproduce
Steps to reproduce the behavior:

  1. Open browser, access ACA, and log in
  2. Close ACA tab (or even entire browser) without explicitly logging out
  3. Open browser/tab, access Share, and log in using the same credentials
  4. Perform explicit logout in Share
  5. Access ACA

Expected behavior
Only ACA login form is shown as authentication ticket in ACS was forcibly invalidated by Share logout

Screenshots
grafik

Desktop (please complete the following information):

  • OS: Win 10 (10.0.19043 Build 19043)
  • Browser: Chrome 101.0.4951.54 (also reproduced in Firefox 100.0.2)

Additional context
Setup is a simple Community Alfresco Content Services with ACA, minimal extension module of the customer (custom routes for own views), and no Alfresco Identity Services integration. Investigation so far indicates presence of a now invalidated / expired ticket in the browser's local storage is used within alfresco-js-api ContentAuth without any validation.
Note that the steps to reproduce use an explicit logout. The issue can be reproduced the same if the steps to use Share are instead replaced with a waiting period until ACS automatically expires the authentication ticket.

@DenysVuika DenysVuika added the bug label Jun 23, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants