You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@couchdb.apache.org by "Robert Newson (JIRA)" <ji...@apache.org> on 2011/02/13 13:22:57 UTC
[jira] Created: (COUCHDB-1066) cookie_authentication_handler does
not throw if cookie is invalid or has expired
cookie_authentication_handler does not throw if cookie is invalid or has expired
--------------------------------------------------------------------------------
Key: COUCHDB-1066
URL: https://issues.apache.org/jira/browse/COUCHDB-1066
Project: CouchDB
Issue Type: Bug
Affects Versions: 1.0.2
Reporter: Robert Newson
Assignee: Robert Newson
Priority: Critical
cookie_authentication_handler does not throw if the cookie is invalid or has expired, instead it delegates to the next handler.
This leads to ugly results like getting a response from /_session but with no userCtx filled in.
cookie_authentication_handler should throw if, and only if, there's an AuthSession cookie that is expired or invalid. We shouldn't attempt to try other auth schemes. If there is no such cookie, then we delegate.
--
This message is automatically generated by JIRA.
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] Updated: (COUCHDB-1066) cookie_authentication_handler does
not throw if cookie is invalid or has expired
Posted by "Robert Newson (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/COUCHDB-1066?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Robert Newson updated COUCHDB-1066:
-----------------------------------
Affects Version/s: 1.1
0.11.2
> cookie_authentication_handler does not throw if cookie is invalid or has expired
> --------------------------------------------------------------------------------
>
> Key: COUCHDB-1066
> URL: https://issues.apache.org/jira/browse/COUCHDB-1066
> Project: CouchDB
> Issue Type: Bug
> Affects Versions: 0.11.2, 1.0.2, 1.1
> Reporter: Robert Newson
> Assignee: Robert Newson
> Priority: Critical
>
> cookie_authentication_handler does not throw if the cookie is invalid or has expired, instead it delegates to the next handler.
> This leads to ugly results like getting a response from /_session but with no userCtx filled in.
> cookie_authentication_handler should throw if, and only if, there's an AuthSession cookie that is expired or invalid. We shouldn't attempt to try other auth schemes. If there is no such cookie, then we delegate.
--
This message is automatically generated by JIRA.
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] Commented: (COUCHDB-1066) cookie_authentication_handler does
not throw if cookie is invalid or has expired
Posted by "Robert Newson (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/COUCHDB-1066?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12994109#comment-12994109 ]
Robert Newson commented on COUCHDB-1066:
----------------------------------------
Further, Filipe's fix works, but because jquery.couch.js does not send 'accept: application/json', it doesn't trigger the code that bypasses the redirect.
> cookie_authentication_handler does not throw if cookie is invalid or has expired
> --------------------------------------------------------------------------------
>
> Key: COUCHDB-1066
> URL: https://issues.apache.org/jira/browse/COUCHDB-1066
> Project: CouchDB
> Issue Type: Bug
> Affects Versions: 0.11.2, 1.0.2, 1.1
> Reporter: Robert Newson
> Assignee: Robert Newson
> Priority: Critical
>
> cookie_authentication_handler does not throw if the cookie is invalid or has expired, instead it delegates to the next handler.
> This leads to ugly results like getting a response from /_session but with no userCtx filled in.
> cookie_authentication_handler should throw if, and only if, there's an AuthSession cookie that is expired or invalid. We shouldn't attempt to try other auth schemes. If there is no such cookie, then we delegate.
--
This message is automatically generated by JIRA.
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (COUCHDB-1066) cookie_authentication_handler
does not throw if cookie is invalid or has expired
Posted by "Jan Lehnardt (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/COUCHDB-1066?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13020647#comment-13020647 ]
Jan Lehnardt commented on COUCHDB-1066:
---------------------------------------
Looks straightforward. +1.
> cookie_authentication_handler does not throw if cookie is invalid or has expired
> --------------------------------------------------------------------------------
>
> Key: COUCHDB-1066
> URL: https://issues.apache.org/jira/browse/COUCHDB-1066
> Project: CouchDB
> Issue Type: Bug
> Affects Versions: 0.11.2, 1.0.2, 1.1
> Reporter: Robert Newson
> Assignee: Robert Newson
> Priority: Critical
>
> cookie_authentication_handler does not throw if the cookie is invalid or has expired, instead it delegates to the next handler.
> This leads to ugly results like getting a response from /_session but with no userCtx filled in.
> cookie_authentication_handler should throw if, and only if, there's an AuthSession cookie that is expired or invalid. We shouldn't attempt to try other auth schemes. If there is no such cookie, then we delegate.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Resolved] (COUCHDB-1066) cookie_authentication_handler does
not throw if cookie is invalid or has expired
Posted by "Robert Newson (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/COUCHDB-1066?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Robert Newson resolved COUCHDB-1066.
------------------------------------
Resolution: Fixed
Fix Version/s: 1.2
1.1
1.0.3
Fixed by COUCHDB-1163.
> cookie_authentication_handler does not throw if cookie is invalid or has expired
> --------------------------------------------------------------------------------
>
> Key: COUCHDB-1066
> URL: https://issues.apache.org/jira/browse/COUCHDB-1066
> Project: CouchDB
> Issue Type: Bug
> Affects Versions: 0.11.2, 1.0.2, 1.1
> Reporter: Robert Newson
> Assignee: Robert Newson
> Priority: Critical
> Fix For: 1.0.3, 1.1, 1.2
>
>
> cookie_authentication_handler does not throw if the cookie is invalid or has expired, instead it delegates to the next handler.
> This leads to ugly results like getting a response from /_session but with no userCtx filled in.
> cookie_authentication_handler should throw if, and only if, there's an AuthSession cookie that is expired or invalid. We shouldn't attempt to try other auth schemes. If there is no such cookie, then we delegate.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] Commented: (COUCHDB-1066) cookie_authentication_handler does
not throw if cookie is invalid or has expired
Posted by "Robert Newson (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/COUCHDB-1066?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12994112#comment-12994112 ]
Robert Newson commented on COUCHDB-1066:
----------------------------------------
Fix here: https://github.com/rnewson/couchdb/compare/COUCHDB-1066
summary: cookie_authentication_handler now throws unauthorized if there's an expired or invalid AuthSession cookie, Futon now sends the Accept header and so does not rewrite the 401 as a 302.
I have verified that successful requires extend the lifetime of the cookie.
> cookie_authentication_handler does not throw if cookie is invalid or has expired
> --------------------------------------------------------------------------------
>
> Key: COUCHDB-1066
> URL: https://issues.apache.org/jira/browse/COUCHDB-1066
> Project: CouchDB
> Issue Type: Bug
> Affects Versions: 0.11.2, 1.0.2, 1.1
> Reporter: Robert Newson
> Assignee: Robert Newson
> Priority: Critical
>
> cookie_authentication_handler does not throw if the cookie is invalid or has expired, instead it delegates to the next handler.
> This leads to ugly results like getting a response from /_session but with no userCtx filled in.
> cookie_authentication_handler should throw if, and only if, there's an AuthSession cookie that is expired or invalid. We shouldn't attempt to try other auth schemes. If there is no such cookie, then we delegate.
--
This message is automatically generated by JIRA.
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] Commented: (COUCHDB-1066) cookie_authentication_handler does
not throw if cookie is invalid or has expired
Posted by "Robert Newson (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/COUCHDB-1066?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12994107#comment-12994107 ]
Robert Newson commented on COUCHDB-1066:
----------------------------------------
I have a local fix that breaks Futon due, I think, to a recent change that translates 401's to 302's. This causes Futon's call to /_active_tasks, to make a modal dialog box of HTML instead of the usual popup about needing admin access.
This commit, once reverted, gives proper 401's;
03ede5b036c48d0a212fac033cd90e5b041913ad
> cookie_authentication_handler does not throw if cookie is invalid or has expired
> --------------------------------------------------------------------------------
>
> Key: COUCHDB-1066
> URL: https://issues.apache.org/jira/browse/COUCHDB-1066
> Project: CouchDB
> Issue Type: Bug
> Affects Versions: 0.11.2, 1.0.2, 1.1
> Reporter: Robert Newson
> Assignee: Robert Newson
> Priority: Critical
>
> cookie_authentication_handler does not throw if the cookie is invalid or has expired, instead it delegates to the next handler.
> This leads to ugly results like getting a response from /_session but with no userCtx filled in.
> cookie_authentication_handler should throw if, and only if, there's an AuthSession cookie that is expired or invalid. We shouldn't attempt to try other auth schemes. If there is no such cookie, then we delegate.
--
This message is automatically generated by JIRA.
-
For more information on JIRA, see: http://www.atlassian.com/software/jira