Login is broken on WebKit based browsers - Githubissues

WrenSecurity / wrenam

Community fork of OpenAM, an authentication and authorization system originally developed by ForgeRock.

Other

43 stars 27 forks source link

Login is broken on WebKit based browsers #176

Open pavelhoral opened 5 months ago

pavelhoral commented 5 months ago

Login on WebKit based browsers does not work due to aborted request in SessionValidator.js.

What happens is that:

after successful authentication with goto parameter, CommonConfig.js sets redirect URL via window.location.href
few lines above that EVENT_AUTHENTICATION_DATA_CHANGED event is fired which in turn fires EVENT_AUTHENTICATED
this starts session validation logic
from this point on the processing differs in WebKit browsers

In non-WebKit browsers:

session validation does not make any requests as the JS promise based processing is stopped after the navigation (setting window.location.href)

In WebKit browsers:

session validation makes the HTTP request for getSessionInfo, however that request gets cancelled (probably due to the navigation in progress)
SessionValidator is able to handle the request failure and navigates user to session expired error page

This issue started appearing probably after upgrading to newer jQuery with updated promise handling.