Skip to content

Commit

Permalink
STCOR-869 do not store /logout as a "return-to" URL
Browse files Browse the repository at this point in the history
When a session ends due to timeout, the current location is stored in
order to allow the subsequent session to begin where the previous one
left off. If the "session timeout" event fires more than once**,
however, this could lead to the `/logout` location being stored as
the "return to" location with obvious dire consequences.

There are two changes here:
1. Don't allow locations beginning with `/logout` to be stored. This
   fixes the symptom, not the root cause, but is still worthwhile.
2. Store the session-timeout interval ID in redux, and manage that timer
   via a redux action. Even though this _still_ shouldn't fire more than
   once, if it does, this allows us to cancel the previous timer before
   adding the next one. This is an attempt to fix the root cause.

Refs STCOR-869
  • Loading branch information
zburke committed Jul 25, 2024
1 parent 8ef05ce commit 319259c
Show file tree
Hide file tree
Showing 4 changed files with 43 additions and 5 deletions.
11 changes: 7 additions & 4 deletions src/components/Root/FFetch.js
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,7 @@ import { okapi as okapiConfig } from 'stripes-config';
import {
setRtrTimeout,
setRtrFlsTimeout,
setRtrFlsWarningTimeout,
} from '../../okapiActions';

import { getTokenExpiry } from '../../loginServices';
Expand Down Expand Up @@ -100,7 +101,7 @@ export class FFetch {
/**
* scheduleRotation
* Given a promise that resolves with timestamps for the AT's and RT's
* expiration, configure relevant corresponding timers:
* expiration, configure relevant corresponding timers:
* * before the AT expires, conduct RTR
* * when the RT is about to expire, send a "session will end" event
* * when the RT expires, send a "session ended" event"
Expand Down Expand Up @@ -131,15 +132,17 @@ export class FFetch {

// schedule FLS end-of-session warning
this.logger.log('rtr-fls', `end-of-session warning at ${new Date(rotationInterval.refreshTokenExpiration - ms(this.rtrConfig.fixedLengthSessionWarningTTL))}`);
this.store.dispatch(setRtrFlsTimeout(setTimeout(() => {
this.store.dispatch(setRtrFlsWarningTimeout(setTimeout(() => {
this.logger.log('rtr-fls', 'emitting RTR_FLS_WARNING_EVENT');
window.dispatchEvent(new Event(RTR_FLS_WARNING_EVENT));
}, rtWarningInterval)));

// schedule FLS end-of-session logout
this.logger.log('rtr-fls', `session will end at ${new Date(rotationInterval.refreshTokenExpiration)}`);
setTimeout(() => {
this.store.dispatch(setRtrFlsTimeout(setTimeout(() => {
this.logger.log('rtr-fls', 'emitting RTR_FLS_TIMEOUT_EVENT');
window.dispatchEvent(new Event(RTR_FLS_TIMEOUT_EVENT));
}, rtTimeoutInterval);
}, rtTimeoutInterval)));
});
};

Expand Down
5 changes: 4 additions & 1 deletion src/loginServices.js
Original file line number Diff line number Diff line change
Expand Up @@ -122,7 +122,10 @@ export const setTokenExpiry = async (te) => {
const UNAUTHORIZED_PATH = 'unauthorized_path';
export const removeUnauthorizedPathFromSession = () => sessionStorage.removeItem(UNAUTHORIZED_PATH);
export const setUnauthorizedPathToSession = (pathname) => {
sessionStorage.setItem(UNAUTHORIZED_PATH, pathname ?? `${window.location.pathname}${window.location.search}`);
const path = pathname ?? `${window.location.pathname}${window.location.search}`;
if (!path.startsWith('/logout')) {
sessionStorage.setItem(UNAUTHORIZED_PATH, pathname ?? `${window.location.pathname}${window.location.search}`);
}
};
export const getUnauthorizedPathFromSession = () => sessionStorage.getItem(UNAUTHORIZED_PATH);

Expand Down
15 changes: 15 additions & 0 deletions src/okapiActions.js
Original file line number Diff line number Diff line change
Expand Up @@ -164,7 +164,20 @@ function clearRtrTimeout() {
};
}

function setRtrFlsWarningTimeout(rtrFlsTimeout) {
return {
type: OKAPI_REDUCER_ACTIONS.SET_RTR_FLS_WARNING_TIMEOUT,
rtrFlsTimeout,
};
}

function clearRtrFlsWarningTimeout() {
return {
type: OKAPI_REDUCER_ACTIONS.CLEAR_RTR_FLS_WARNING_TIMEOUT,
};
}
function setRtrFlsTimeout(rtrFlsTimeout) {
OKAPI_REDUCER_ACTIONS.SET_RTR_FLS_TIMEOUT

Check failure on line 180 in src/okapiActions.js

View workflow job for this annotation

GitHub Actions / build-npm

Expected an assignment or function call and instead saw an expression

Check failure on line 180 in src/okapiActions.js

View workflow job for this annotation

GitHub Actions / build-npm

Missing semicolon

Check failure on line 180 in src/okapiActions.js

View workflow job for this annotation

GitHub Actions / build-npm

Expected an assignment or function call and instead saw an expression

Check failure on line 180 in src/okapiActions.js

View workflow job for this annotation

GitHub Actions / build-npm

Missing semicolon
return {
type: OKAPI_REDUCER_ACTIONS.SET_RTR_FLS_TIMEOUT,
rtrFlsTimeout,
Expand All @@ -190,6 +203,7 @@ export {
clearCurrentUser,
clearOkapiToken,
clearRtrFlsTimeout,
clearRtrFlsWarningTimeout,
clearRtrTimeout,
setAuthError,
setBindings,
Expand All @@ -203,6 +217,7 @@ export {
setOkapiToken,
setPlugins,
setRtrFlsTimeout,
setRtrFlsWarningTimeout,
setRtrTimeout,
setServerDown,
setSessionData,
Expand Down
17 changes: 17 additions & 0 deletions src/okapiReducer.js
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ export const OKAPI_REDUCER_ACTIONS = {
CLEAR_CURRENT_USER: 'CLEAR_CURRENT_USER',
CLEAR_OKAPI_TOKEN: 'CLEAR_OKAPI_TOKEN',
CLEAR_RTR_FLS_TIMEOUT: 'CLEAR_RTR_FLS_TIMEOUT',
CLEAR_RTR_FLS_WARNING_TIMEOUT: 'CLEAR_RTR_FLS_WARNING_TIMEOUT',
CLEAR_RTR_TIMEOUT: 'CLEAR_RTR_TIMEOUT',
OKAPI_READY: 'OKAPI_READY',
SERVER_DOWN: 'SERVER_DOWN',
Expand All @@ -18,6 +19,7 @@ export const OKAPI_REDUCER_ACTIONS = {
SET_OKAPI_TOKEN: 'SET_OKAPI_TOKEN',
SET_PLUGINS: 'SET_PLUGINS',
SET_RTR_FLS_TIMEOUT: 'SET_RTR_FLS_TIMEOUT',
SET_RTR_FLS_WARNING_TIMEOUT: 'SET_RTR_FLS_WARNING_TIMEOUT',
SET_RTR_TIMEOUT: 'SET_RTR_TIMEOUT',
SET_SESSION_DATA: 'SET_SESSION_DATA',
SET_SINGLE_PLUGIN: 'SET_SINGLE_PLUGIN',
Expand Down Expand Up @@ -47,9 +49,11 @@ export default function okapiReducer(state = {}, action) {
// if we're logging out, clear the RTR timeouts and related values
if (!action.isAuthenticated) {
clearTimeout(state.rtrTimeout);
clearTimeout(state.rtrFlsWarningTimeout);
clearTimeout(state.rtrFlsTimeout);
newState.rtrModalIsVisible = false;
newState.rtrTimeout = undefined;
newState.rtrFlsWarningTimeout = undefined;
newState.rtrFlsTimeout = undefined;
}

Expand Down Expand Up @@ -99,10 +103,23 @@ export default function okapiReducer(state = {}, action) {
clearTimeout(state.rtrTimeout);
return { ...state, rtrTimeout: action.rtrTimeout };
}

case OKAPI_REDUCER_ACTIONS.CLEAR_RTR_TIMEOUT: {
clearTimeout(state.rtrTimeout);
return { ...state, rtrTimeout: undefined };
}

// clear existing FLS warning timeout and set a new one
case OKAPI_REDUCER_ACTIONS.SET_RTR_FLS_WARNING_TIMEOUT: {
clearTimeout(state.rtrFlsWarningTimeout);
return { ...state, rtrFlsWarningTimeout: action.rtrFlsWarningTimeout };
}

case OKAPI_REDUCER_ACTIONS.CLEAR_RTR_FLS_WARNING_TIMEOUT: {
clearTimeout(state.rtrFlsWarningTimeout);
return { ...state, rtrFlsWarningTimeout: undefined };
}

// clear existing FLS timeout and set a new one
case OKAPI_REDUCER_ACTIONS.SET_RTR_FLS_TIMEOUT: {
clearTimeout(state.rtrFlsTimeout);
Expand Down

0 comments on commit 319259c

Please sign in to comment.