inventree / InvenTree

Open Source Inventory Management System
https://docs.inventree.org
MIT License
4.19k stars 754 forks source link

Samesite cookie `None` causes errors #8254

Closed GoryMoon closed 2 days ago

GoryMoon commented 3 days ago

Please verify that this bug has NOT been raised before.

Describe the bug*

When some users login the following error occurs in the AllAuth library: 'NoneType' object has no attribute 'lower' Then they are given an error that they couldn't login but refreshing the page shows them that they are logged in.

I haven set the INVENTREE_COOKIE_SAMESITE yet and the default value is None now. This isn't happening 100% of the times, not sure what changed between but I've noticed the following. From the looks of it the code sets the python None and not the string 'None' causing issues in AllAuth.

Based on the docs it should be a string: https://docs.djangoproject.com/en/5.1/ref/settings/#std-setting-SESSION_COOKIE_SAMESITE

Steps to Reproduce

  1. Setup a OAuth login method.
  2. Don't set the INVENTREE_COOKIE_SAMESITE setting.
  3. Login
  4. Get auto logged out from session expire and get redirected to login
  5. Try login again

Expected behaviour

That the error doesn't happen and the users getting logged in correctly.

Deployment Method

Version Information

Version Information:

InvenTree-Version: 0.16.4 Django Version: 4.2.15 Commit Hash: 83be1b8 Commit Date: 2024-09-30

Database: postgresql Debug-Mode: False Deployed using Docker: True Platform: Linux-6.1.21-v8+-aarch64-with Installer: DOC

Active plugins: [{'name': 'InvenTreeBarcode', 'slug': 'inventreebarcode', 'version': '2.1.0'}, {'name': 'InvenTreeCoreNotificationsPlugin', 'slug': 'inventreecorenotificationsplugin', 'version': '1.0.0'}, {'name': 'InvenTreeCurrencyExchange', 'slug': 'inventreecurrencyexchange', 'version': '1.0.0'}, {'name': 'InvenTreeLabel', 'slug': 'inventreelabel', 'version': '1.1.0'}, {'name': 'InvenTreeLabelMachine', 'slug': 'inventreelabelmachine', 'version': '1.0.0'}, {'name': 'InvenTreeLabelSheet', 'slug': 'inventreelabelsheet', 'version': '1.0.0'}, {'name': 'DigiKeyPlugin', 'slug': 'digikeyplugin', 'version': '1.0.0'}, {'name': 'LCSCPlugin', 'slug': 'lcscplugin', 'version': '1.0.0'}, {'name': 'MouserPlugin', 'slug': 'mouserplugin', 'version': '1.0.0'}, {'name': 'TMEPlugin', 'slug': 'tmeplugin', 'version': '1.0.0'}]

Please verify if you can reproduce this bug on the demo site.

Relevant log output

Environment:

Request Method: GET Request URL: http://.../accounts/x2/login/callback/?code=...&state=...

Django Version: 4.2.15 Python Version: 3.11.9 Installed Applications: ['django.contrib.admin', 'build.apps.BuildConfig', 'common.apps.CommonConfig', 'company.apps.CompanyConfig', 'plugin.apps.PluginAppConfig', 'order.apps.OrderConfig', 'part.apps.PartConfig', 'report.apps.ReportConfig', 'stock.apps.StockConfig', 'users.apps.UsersConfig', 'machine.apps.MachineConfig', 'importer.apps.ImporterConfig', 'web', 'generic', 'InvenTree.apps.InvenTreeConfig', 'django.contrib.auth', 'django.contrib.contenttypes', 'user_sessions', 'whitenoise.runserver_nostatic', 'django.contrib.messages', 'django.contrib.staticfiles', 'maintenance_mode', 'django_filters', 'rest_framework', 'corsheaders', 'crispy_forms', 'import_export', 'django_cleanup.apps.CleanupConfig', 'mptt', 'markdownify', 'djmoney', 'djmoney.contrib.exchange', 'error_report', 'django_q', 'formtools', 'dbbackup', 'taggit', 'flags', 'allauth', 'allauth.account', 'allauth.socialaccount', 'django_otp', 'django_otp.plugins.otp_totp', 'django_otp.plugins.otp_static', 'allauth_2fa', 'dj_rest_auth', 'dj_rest_auth.registration', 'drf_spectacular', 'django_ical', 'allauth.socialaccount.providers.openid_connect'] Installed Middleware: ['django.middleware.security.SecurityMiddleware', 'x_forwarded_for.middleware.XForwardedForMiddleware', 'user_sessions.middleware.SessionMiddleware', 'django.middleware.locale.LocaleMiddleware', 'django.middleware.csrf.CsrfViewMiddleware', 'corsheaders.middleware.CorsMiddleware', 'whitenoise.middleware.WhiteNoiseMiddleware', 'django.middleware.common.CommonMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'InvenTree.middleware.InvenTreeRemoteUserMiddleware', 'django_otp.middleware.OTPMiddleware', 'InvenTree.middleware.CustomAllauthTwoFactorMiddleware', 'allauth.account.middleware.AccountMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', 'django.middleware.clickjacking.XFrameOptionsMiddleware', 'InvenTree.middleware.AuthRequiredMiddleware', 'InvenTree.middleware.Check2FAMiddleware', 'maintenance_mode.middleware.MaintenanceModeMiddleware', 'InvenTree.middleware.InvenTreeExceptionProcessor']

Traceback (most recent call last): File "/root/.local/lib/python3.11/site-packages/django/core/handlers/base.py", line 197, in _get_response response = wrapped_callback(request, *callback_args, *callback_kwargs) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/root/.local/lib/python3.11/site-packages/allauth/socialaccount/providers/openid_connect/views.py", line 76, in callback return view(request) ^^^^^^^^^^^^^ File "/root/.local/lib/python3.11/site-packages/allauth/socialaccount/providers/oauth2/views.py", line 103, in view return self.dispatch(request, args, **kwargs) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/root/.local/lib/python3.11/site-packages/allauth/socialaccount/providers/oauth2/views.py", line 118, in dispatch state, resp = self._get_state(request, provider) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/root/.local/lib/python3.11/site-packages/allauth/socialaccount/providers/oauth2/views.py", line 190, in _get_state resp = self._redirect_strict_samesite(request, provider) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/root/.local/lib/python3.11/site-packages/allauth/socialaccount/providers/oauth2/views.py", line 166, in _redirect_strict_samesite or settings.SESSION_COOKIE_SAMESITE.lower() != "strict" ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Exception Type: AttributeError at /accounts/x2/login/callback/ Exception Value: 'NoneType' object has no attribute 'lower'

SchrodingersGat commented 3 days ago

@GoryMoon thanks for reporting, fix incoming in https://github.com/inventree/InvenTree/pull/8262