search

Chainlit / chainlit

Build Conversational AI in minutes ⚡️
https://docs.chainlit.io
Apache License 2.0
6.76k stars 878 forks source link

Logout Button Causing Issue w/ Header Auth #1219

Open marty-sullivan opened 1 month ago

marty-sullivan commented 1 month ago

Describe the bug It appears like header-based login might break after clicking the logout button. I will admit, I'm doing something a little different than what is designed, as is described here:

https://github.com/Chainlit/chainlit/issues/144#issuecomment-2227005294

Given that though, I'm seeing some very odd behavior as described below. It doesn't seem like it should matter that I'm using something from the referrer header vs some other header.

To Reproduce Steps to reproduce the behavior:

The logs show the following...

  1. User authenticates using the header method I use, linked above
  2. User clicks on logout button
  3. User tries to log in again by being directed to /login?token=...
  4. User is redirected to /auth/header and header_auth_callback succeeds (returns valid User)
  5. User is redirected to chat
  6. User is immediately redirected back to /login and then back to /auth/header
  7. header_auth_callback fails (returns None because there is no token query param)
  8. User is redirected back to /auth/header a second time
  9. header_auth_callback fails (returns None because)

Expected behavior I would expect that the user is successfully logged in on the first redirect to /auth/header but it seems like after the user manually logs out, it somehow makes it so that the header login flow is failing to set the User for the session.

I'm certainly willing to accept that what I'm doing isn't supported, however, this behavior is not something I've run into and only seems to happen after the user manually logs out. It's almost like a cookie or session storage item is no longer able to be set by the header login flow.

I have tried clearing browser cookies and data and all of that, it doesn't seem to help once the user clicks that button. Very mysterious.

marty-sullivan commented 1 month ago

Some additional tests show that this problem does not seem to happen with v1.1.306

dokterbob commented 3 weeks ago

Is this perhaps related to #1207?

marty-sullivan commented 3 weeks ago

@dokterbob I don't think so, I was just using the basic header auth, not oauth