Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add test to handle redirects in CURL test transport and add a redirect test run #8008

Closed
sync-by-unito bot opened this issue Aug 28, 2024 · 3 comments · May be fixed by #8011
Closed

Add test to handle redirects in CURL test transport and add a redirect test run #8008

sync-by-unito bot opened this issue Aug 28, 2024 · 3 comments · May be fixed by #8011
Assignees
@michael-wb

Comments

@sync-by-unito
Copy link

sync-by-unito bot commented Aug 28, 2024

Update the CURL lib driver (do_http_request()) so it handles redirects and either add a new test run that forces redirects to happen or updates the existing "Ubuntu (Baas Redirector Enabled)" and "Ubuntu (Code Coverage)" test runs to also perform App Services redirects during the tests.
@sync-by-unito Sync by Unito
Copy link
Author

sync-by-unito bot commented Aug 28, 2024

➤ PM Bot commented:

Jira ticket: RCORE-2252

@sync-by-unito Sync by Unito
Copy link
Author

sync-by-unito bot commented Aug 29, 2024

➤ michael-wb commented:

I just discovered that CURL does not send the Authorization header field on redirect (for obvious security reasons), which results in any user-based app services operations receiving a 401 must authenticate first error if they original endpoint URL responds with a 301/308 redirect message and the request is sent again to the new address in the redirect response. As a result, the user is logged out, since the authenticated response fails.

For most situations, the client app will not encounter this situation, since the location endpoint is requested prior to sending the first app services request after the app was started. This particular situation could happen if the deployment model was changed while the client app was running and the app requested an access token refresh. Fortunately, the user was automatically logged out when the deployment model was changed, so the user would need to log in again anyways.

A potential fix for this would be to always query the location prior to performing a login, which will help ensure the client app has the appropriate base URL for the server, since the location response always includes the most up to date information for the server host and websocket host URLs for accessing the cloud app.

@sync-by-unito Sync by Unito
Copy link
Author

sync-by-unito bot commented Aug 29, 2024

➤ michael-wb commented:

Example wireshark capture of request packets and their responses
Original request:

GET /api/client/v2.0/auth/profile HTTP/1.1
Host: localhost:63526
Accept: application/json
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJiYWFzX2RldmljZV9pZCI6IjY2ZDA4NmYyMjgzODhiMjkxYzg4MjJjYSIsImJhYXNfZG9tYWluX2lkIjoiNjZkMDg2ZDgyODM4OGIyOTFjODgyMTM2IiwiZXhwIjoxNzI0OTQzODY2LCJpYXQiOjE3MjQ5NDIwNjYsImlzcyI6IjY2ZDA4NmYyMjgzODhiMjkxYzg4MjJjYyIsImp0aSI6IjY2ZDA4NmYyMjgzODhiMjkxYzg4MjJjZSIsInN0aXRjaF9kZXZJZCI6IjY2ZDA4NmYyMjgzODhiMjkxYzg4MjJjYSIsInN0aXRjaF9kb21haW5JZCI6IjY2ZDA4NmQ4MjgzODhiMjkxYzg4MjEzNiIsInN1YiI6IjY2ZDA4NmYyMjgzODhiMjkxYzg4MjJjOCIsInR5cCI6ImFjY2VzcyJ9.j9qgcsjdTCgfuLOEuN1IL141jBmFwisZJet1VFrK7zI
Content-Type: application/json;charset=utf-8

Redirect response:

HTTP/1.1 301 Moved Permanently
location: http://localhost:9090/api/client/v2.0/auth/profile

<html><body><p>301 Moved Permanently to <a href="http://localhost:9090/api/client/v2.0/auth/profile">http://localhost:9090/api/client/v2.0/auth/profile</a></p></body></html>

Request to redirected location URL:

GET /api/client/v2.0/auth/profile HTTP/1.1
Host: localhost:9090
Accept: application/json
Content-Type: application/json;charset=utf-8

Response from redirect location URL:

HTTP/1.1 401 Unauthorized
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: application/json
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Vary: Origin
X-Appservices-Request-Id: 66d086f228388b291c8822cf
X-Envoy-Max-Retries: 0
X-Frame-Options: DENY
Date: Thu, 29 Aug 2024 14:34:26 GMT
Content-Length: 24

{"error":"unauthorized"}

@michael-wb michael-wb mentioned this issue Aug 29, 2024
Open
2 tasks
@michael-wb michael-wb linked a pull request Aug 29, 2024 that will close this issue
RCORE-2253 Redirected user authenticated app requests cause user to be logged out and location is not updated #8011
Open
2 tasks
@sync-by-unito sync-by-unito bot closed this as completed Sep 13, 2024
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Oct 13, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@michael-wb michael-wb

Labels
None yet
Projects
None yet
Milestone
No milestone
1 participant
@michael-wb