SSO 会话超时

贡献 错误
1

Hello guys! I’m presently working on integrating Discourse with our site as an inward dialog board for senior clients of the framework. We are clearly utilizing the SSO include for this, and that bit is working fine and dandy.

One of the necessities of this combination is that we have to actualize a short session timeout to coordinate the primary site. As of now I have the most extreme session length set to Discourse’s base of 60 minutes. It appears as though setting this does work and the session expires, be that as it may, the manner in which this collaborates with the SSO highlight is by all accounts somewhat broken – on the off chance that I leave my program tab inert for over 60 minutes, returning and tapping on any of the connections, (for example, “Best” or “Most recent”) results in a system mistake:

System Error

while endeavoring to stack/latest.json?order=default

That forum_signon URL is the SSO endpoint. It would seem that what Discourse is doing is reacting to the AJAX ask for/latest.json with a 302 divert to the SSO URL, which at that point comes up short in light of the fact that the SSO supplier doesn’t permit the CORS ask. Truth be told by the Network board the solicitations go/latest.json →/session/sso → Do My Management Homework - Do My Homework Online Do My Homework Online

Note that I did likewise take a stab at adjusting the SSO supplier to set an Access-Control-Allow-Origin header, yet this didn’t appear to help either.

1 个赞
2

Interesting bug, we usually send an HTTP header back saying you have been logged out, but if that redirects and the client can not follow the redirect it is probably not getting the header.

@david can you add to your list to investigate this.

  • Site requires login
  • Site has SSO defined (you can point local at meta or something)
  • You are on latest page
  • You delete cookies

What should happen is we should pop up the dialog saying you were logged out. But maybe the redirect is throwing the internals off.

2 个赞
4

我按照 @sam 列出的步骤操作，弹出了以下错误：

40
401262×266 21.5 KB

但我确实成功复现了 OP 的问题。该错误非常具体地发生在服务器的认证令牌（auth tokens）过期时。如果在客户端删除 Cookie，则一切正常。将此问题重新归类为 Contribute > Bug

为了便于复现，将会话时长设置为 1 小时，并通过 SSO 登录。使用以下命令伪造即将过期的令牌：

time = 2.hours.ago
UserAuthToken.update_all(rotated_at: time, created_at: time, updated_at: time, seen_at: time)
4 个赞
5

For me, the error happens even when just deleting the cookies, due I believe to the CORS failure as @Michal_Spak mentioned (GET latest.json 302 → GET sso 302 → OPTIONS primary site → failure).

@david - could your attempt to repro have failed because you have some exciting CORS options which means meta.discourse.org allows your request?

2 个赞