vyommani commented on code in PR #1200:
URL: https://github.com/apache/ranger/pull/1200#discussion_r3902640427
##########
security-admin/src/main/java/org/apache/ranger/security/web/filter/RangerKRBAuthenticationFilter.java:
##########
@@ -682,6 +689,30 @@ protected Configuration getProxyuserConfiguration() {
return conf;
}
+ private void handleConcurrentSessionExpiredRequest(HttpServletRequest
httpRequest, HttpServletResponse httpResponse) throws IOException {
+ HttpSession httpSession = httpRequest.getSession(false);
Review Comment:
For the non-SSO branch, this always does `httpSession.invalidate()` +
`httpResponse.sendRedirect(...)` regardless of whether the request is a full
page load or an XHR/fetch call from the React UI. That's inconsistent with the
AJAX-aware convention already used elsewhere in this codebase
`RangerAuthenticationEntryPoint` and `RangerSSOAuthenticationFilter` both check
the `X-Requested-With: XMLHttpRequest` header and respond with
`RangerConstants.SC_AUTHENTICATION_TIMEOUT` (419) + an `X-Rngr-Redirect-Url`
header for AJAX calls, reserving `sendRedirect` for full-page navigations.
As written, an in-flight XHR call from the SPA that lands here will
auto-follow the 302 and get `login.jsp`'s HTML back where JSON was expected,
which the frontend likely won't handle gracefully. Could this reuse the same
XMLHttpRequest-aware pattern as `RangerAuthenticationEntryPoint`, instead of an
unconditional `sendRedirect`?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
