[
https://issues.apache.org/jira/browse/BROOKLYN-323?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15411849#comment-15411849
]
ASF GitHub Bot commented on BROOKLYN-323:
-----------------------------------------
Github user neykov commented on a diff in the pull request:
https://github.com/apache/brooklyn-server/pull/288#discussion_r73880683
--- Diff:
rest/rest-resources/src/main/java/org/apache/brooklyn/rest/resources/LogoutResource.java
---
@@ -37,32 +37,45 @@
@Context UriInfo uri;
@Override
+ public Response redirectToLogout() {
+ URI dest = uri.getBaseUriBuilder().path(LogoutApi.class).build();
+
+ // Return response with Javascript which will make an asynchronous
POST request to the logout method.
+ // (When calling logout it is important to use wrong username and
password in order to make browser forget the old ones)
+ return Response.status(Status.OK)
+ .entity(String.format("<!DOCTYPE html>\n<body>\n" +
+ "<script>\n" +
+ "var a=new window.XMLHttpRequest;" +
+ "a.open('POST','%1$s',0,'user','wrong'+(new
Date).getTime().toString());a.send(\"\");\n" +
+ "window.location.href='/';</script></body>",
dest.toASCIIString()))
+ .build();
+ }
+
+ @Override
public Response logout() {
WebEntitlementContext ctx = (WebEntitlementContext)
Entitlements.getEntitlementContext();
- URI dest =
uri.getBaseUriBuilder().path(LogoutApi.class).path(LogoutApi.class,
"logoutUser").build(ctx.user());
- // When execution gets here we don't know whether this is the
first fetch of logout() or a subsequent one
- // with a re-authenticated user. The only way to tell is compare
if user names changed. So redirect to an URL
- // which contains the user name.
- return Response.status(Status.TEMPORARY_REDIRECT)
+ if (ctx != null && ctx.user() != null) {
+ doLogout();
+ }
+
+ URI dest = uri.getBaseUriBuilder().build();
+
+ return Response.status(Status.UNAUTHORIZED)
+ .header("WWW-Authenticate", "Basic realm=\"webconsole\"")
+ // For Status 403, HTTP Location header may be omitted.
+ // Location is best to be used for http status 302
https://tools.ietf.org/html/rfc2616#section-10.3.3
.header("Location", dest.toASCIIString())
+ .entity("<script>window.location.replace(\"/\");</script>")
--- End diff --
I think we should keep previous behaviour here and for `logoutUser`.
Changes in https://github.com/apache/brooklyn-ui/pull/30 don't actually use the
`lougout` call anyway - they rely on javascript to invalidate the
authentication header.
Why it's needed (for clients that use it):
* a client posts to /logout
* server returns 401
* browser displays an authentication dialog
* browser retries request with new credentials (against /logout)
* server return 401 (because that's all it does)
* credentials appear to be invalid
How current code fixes this:
* a client posts to /logout
* server redirects to /logout/username
* server returns 401
* browser display an authentication dialog
* browser retries request with new credentials (against /logout/username)
* server returns 200 if new username doesn't match username in URL or 401
if it matches
> Inconsistent logout behavior for Basic Authentication
> -----------------------------------------------------
>
> Key: BROOKLYN-323
> URL: https://issues.apache.org/jira/browse/BROOKLYN-323
> Project: Brooklyn
> Issue Type: Bug
> Affects Versions: 0.9.0, 0.10.0, 0.9.1
> Environment: Firefox, Internet Explorer, Google Chrome
> Reporter: Valentin Aitken
> Fix For: 0.10.0
>
>
> Observed behavior:
> When clicking logout browser asks for a password.
> When entering a password browser asks you sequentially to enter username and
> password.
> How logout should be implemented for Basic Authentication:
> http://stackoverflow.com/questions/233507/how-to-log-out-user-from-web-site-using-basic-authentication
> My explanation for behavior with the current code:
> First to clear out how brooklyn-ui is working and what it does.
> It polls infinitely the brooklyn api to retrieve status for the applications
> which are on the dashboard.
> To do that each request has to be authenticated.
> Logout:
> When user click logout, UI fires an ajax call to get a a proper Unauthorized
> response.
> Current response for the logout request contains Unauthorized response which
> should invalidate credentials.
> For Google Chrome it does invalidate the request credentials but it does not
> reload the DOM (or the webpage)
> When user try to type username and password to login back again, it is
> followed by another username and password prompt.
> My explanation for this is that login actually appeared from one of the
> application status calls rather than the index page and credentials are not
> populated through the DOM.
> Because of this credentials have to be typed for every single request and UI
> is making status calls infinitely so in other words user have to enter
> username and password infinitely.
> However for Internet Explorer it behaves differently.
> It just unauthenticate the one Ajax request and from there nothing happens.
> Deletion of the session within Internet Explorer doesn't happen and browser
> stays authenticated.
> My idea for solving those problems is to do a full reload of the web page
> after deauthenticating.
> so Brooklyn can have only one javascript authentication cycle.
> I will provide a solution which does that in one simple step.
> Calling the /logout API call which returns Unauthorized response and redirect
> to the home page.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
