[Bug]: Login Success failing transactional webhook doesn't stop a SSO session

[mooreds]

What happened?

This is behavior I would not expect, so I'm filing this issue.

If you set up a transactional webhook listening for the login success event and return a 500, it fails a login of authenticationType PASSWORD but not if the login event happens via SSO (authenticationType of PING).

To replicate:

• stand up a webhook receiver (php code below for ease of use, just run it with php -S 0.0.0.0:8000
• associate it with the login success event in webhooks tab
• enable it on the tenant with a transaction level of 'all webhooks must succeed'
• stand up the nodesso example apps: https://github.com/FusionAuth/fusionauth-example-node-sso/
• try to log into either of them. you'll notice that you are blocked
• uncomment the commented out code below (which only responds to pings)
• log in to one application using username/password
• open network inspector
• try to SSO to the other one

You'll succeed. If you look at the network tab, you can see that the authorize path from FusionAuth is called.

I'd expect it to fail because a non 2xx status code is returned.

<?php
require __DIR__. '/config.php';
require __DIR__ . '/vendor/autoload.php';

$input = file_get_contents('php://input');

$obj = json_decode($input);
if (!$obj) { 
  error_log("Invalid JSON");
  return;
}

$type = $obj->event->type;
if ($type !== "user.login.success") {
  error_log("Sorry, we only handle login success events.");
  http_response_code(200);
  return;
}

/*
$authenticationType = $obj->event->authenticationType;
if ($authenticationType !== "PING") {
  error_log("Sorry, we only handle pings.");
  http_response_code(200);
  return;
}
*/

$applicationId = $obj->event->applicationId;
if ($applicationId == "3c219e58-ed0e-4b18-ad48-f4f92793ae32") {
  error_log("Never prevent login to FusionAuth admin UI");
  http_response_code(200);
  return;
}

http_response_code(500);

?>

Version

1.51.1

Affects Versions

No response

[mooreds]

If we fix this, we should update this doc: https://github.com/FusionAuth/fusionauth-site/pull/3148

[jobannon]

related? https://github.com/FusionAuth/fusionauth-issues/issues/2643