Repository navigation
fix: answer 401 instead of a login redirect to non-HTML Studio requests - #39296
blarghmatey wants to merge 2 commits into
Conversation
Studio views protected by login_required redirect an unauthenticated request to LOGIN_URL. A script follows that redirect, and with LMS SSO each request then starts an OAuth login of its own. When a Studio session expires under an open authoring MFE page, the page's parallel requests start that many logins against one session. social-core keeps the OAuth state in a single session key, so the logins overwrite each other and all but a few fail in validate_state with AuthStateForbidden or AuthStateMissing, which Studio serves as a 500. This adds a Studio middleware that replaces a redirect to LOGIN_URL with a 401 when the request is anonymous and its Accept header does not include text/html. That is the test SafeSessionMiddleware uses when it rejects a session, except that a request with no Accept header keeps the redirect here. Claude-Session: https://claude.ai/code/session_01Rr6xsQQbrmFiSgQWMHJSA2
openedx-webhooks
added
the
open-source-contribution
|
Thanks for the pull request, @blarghmatey! This repository is currently maintained by Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review. 🔘 Get product approvalIf you haven't already, check this list to see if your contribution needs to go through the product review process.
🔘 Provide contextTo help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:
🔘 Get a green buildIf one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green. DetailsWhere can I find more information?If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources: When can I expect my changes to be merged?Our goal is to get community contributions seen and reviewed as efficiently as possible. However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:
💡 As a result it may take up to several weeks or months to complete a review and merge your PR. |
…ests TestLibraryAccess.test_creation (ajax_post) and TestCourseReIndex.test_reindex_course (Accept: application/json) asserted the login redirect for an anonymous request. Neither request accepts text/html, so LoginRedirectToUnauthorizedMiddleware now answers it with 401. Claude-Session: https://claude.ai/code/session_01JxJWMHVXsuXaChbeEpKT8t
Description
Most Studio views are protected by
login_required, which redirects an anonymous request toLOGIN_URL. A script follows that redirect, and with LMS SSO each request then starts an OAuth login of its own. When the Studio session expires under an open Authoring MFE page, the page's parallel requests start that many logins against one session. social-core keeps the OAuthstatein a single session key, so the logins overwrite each other and all but a few fail invalidate_statewithAuthStateForbiddenorAuthStateMissing, which Studio serves as a 500. When the MFE is on another origin, the browser instead blocks the followed redirect at the LMS/oauth2/authorizeand the request fails with no response. Either way the MFE never sees a response it can act on.This adds
LoginRedirectToUnauthorizedMiddlewareto Studio. It replaces a redirect toLOGIN_URLwith a 401 when the request is anonymous and itsAcceptheader does not includetext/html. That is the testSafeSessionMiddlewarealready uses when it rejects a session, with one difference: a request with noAcceptheader keeps the redirect here, whereSafeSessionMiddlewareanswers it with 401. Page navigations keep the redirect. The middleware sets thestudio_login_redirect_replacedcustom attribute when it replaces a redirect.Roles affected: Course Author. A non-HTML client that relied on following the redirect to the login page gets a 401 instead.
Supporting information
/xblock/outline/requests within a minute. 7 of the logins they started completed, and the rest failed invalidate_state, which Studio served as 262 HTTP 500 responses in that minute.Testing instructions
cms/djangoapps/contentstore/tests/test_middleware.pycovers a 401 for anonymous non-HTML GET and POST requests, the redirect kept for HTML and for a missingAcceptheader, authenticated requests and other responses passing through, and each form ofLOGIN_URL. It passes locally (15 tests). Two existing tests asserted the redirect for an anonymous request that does not accept HTML and now expect 401:TestLibraryAccess.test_creation(an AJAX POST) andTestCourseReIndex.test_reindex_course(Accept: application/json).Against a running Studio, with no session cookie:
curl -i -H 'Accept: application/json' <studio>/xblock/outline/<usage key>returns 401.curl -i -H 'Accept: text/html' <studio>/xblock/outline/<usage key>returns 302 to/login/.I have not run step 3 end to end.
Deadline
None.
https://claude.ai/code/session_01JxJWMHVXsuXaChbeEpKT8t