[GitHub] [incubator-superset] durchgedreht opened a new issue #8113: Infinite Redirect loop when using JWT Token based CustomAuth

[GitBox <gi...@apache.org>]

durchgedreht opened a new issue #8113: Infinite Redirect loop when using JWT Token based CustomAuth
URL: https://github.com/apache/incubator-superset/issues/8113
 
 
   I'm trying to use JWT authentication, but have a problem where one get's redirected in an infinite loop. The token gets validated ok and the user registration works (a user is auto created when he was logged in by token and was not existing). 
   
   But somehow the requested url (no matter which - "../dashboard/list", ".../welcome",... "/login") will all lead to an infinite loop logging in again. Any hint would be appreciated.
   
   
   ### Expected results
   
   Result should be a correct redirect to the original requests destination.
   
   ### Actual results
   
   Endless loop of redirects to login url.
   
   #### Code to reproduce the bug
   
   ```
   `
   import logging
   from flask import redirect, g, flash, request
   from flask_appbuilder.security.views import UserDBModelView, AuthDBView
   from superset.security import SupersetSecurityManager
   from flask_appbuilder.security.views import expose
   from flask_appbuilder.security.manager import BaseSecurityManager
   from flask_login import login_user, logout_user
   import requests
   import sys
   import json
   
   from flask_jwt_extended import JWTManager
   from flask_jwt_extended import (create_access_token, create_refresh_token, jwt_required, jwt_refresh_token_required, get_jwt_identity, get_raw_jwt)
   
   class CustomAuthDBView(AuthDBView):
   
   @jwt_required
   @expose('/login/', methods=['GET', 'POST'])
   def login(self):
       logger = self.appbuilder.app.logger
       logger.info("CustomAuthDBView.login)
   
       jwt_json = get_raw_jwt()
       logger.info(jwt_json)
       jwt_aud = jwt_json['aud']  # sample value: '1',
       jwt_user = jwt_json['user']
   
       account_id = jwt_user['account_id']
       login = jwt_user['login']
   
       redirect_url = self.appbuilder.get_url_for_index
       logger.debug("redirect_url = {}".format(redirect_url))
   
       if request.args.get('redirect') is not None:
           redirect_url = request.args.get('redirect')
           print("Redirect URL found in request", flush=True)
   
       user = self.appbuilder.sm.find_user(username = login)
       if user is None:
           logger.info("create user")
           user = self.appbuilder.sm.add_user(
               username = login,
               first_name = "First",
               last_name = "Last",
               email = login,
               role='Alpha'
               #role=self.appbuilder.sm.find_role(self.appbuilder.sm.auth_user_registration_role)
           )
       #self.appbuilder.sm.update_user_auth_stat(user, True)
       login_user(user, remember=True)
   
       redirect_url = "/dashboard/list/"
       return redirect(redirect_url)
   class CustomSecurityManager(SupersetSecurityManager):
   print("load sCustomSecurityManager)
   authdbview = CustomAuthDBView
   
   def load_user(self, user_id):
       logger = self.appbuilder.app.logger
       logger.info("load user {}".format(user_id))
       user = self.find_user(username=user_id)
       return user
   
   def __init__(self,  appbuilder):
       jwt = JWTManager(appbuilder.app)
       super(CustomSecurityManager, self).__init__(appbuilder)
   `
   ```
   
   ### Environment
   
   (please complete the following information):
   
   - superset version: `0.34.0rc1`
   - python version: `python 3.6`
   
   ### Checklist
   
   Make sure these boxes are checked before submitting your issue - thank you!
   
   - [x] I have checked the superset logs for python stacktraces and included it here as text if there are any.
   - [x] I have reproduced the issue with at least the latest released version of superset.
   - [x] I have checked the issue tracker for the same issue and I haven't found one similar.
   

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services

---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org