auth.requires_login redirect and session expiration

[DenesL]

Hi

an expired session becomes empty but this does not seem to always trigger auth.requires_login redirection to the login URL neither when set via auth.requires_login(loginURL), aka the otherwise parameter, nor by auth.settings.on_failed_authorization = loginURL when XMLHttpRequest (XHR) is used.
Actually the otherwise parameter is superfluous in this case.

Status 401 UNAUTHORIZED with response
<div class="not-authorized alert alert-block"><h4>NOT AUTHORIZED</h4>Please <a href="">login</a> to view this content.</div>
but that is never seen since I am using www.idangero.us/framework7 , which loads all links with Ajax by default, does not refresh the page.

So this probably happens because the call is being treated as a component by web2py.
I can get around this by defining the links as external in framework7 but I wonder if it would not be better to have a way to tell web2py to redirect when the session has expired even when using Ajax calls.

Thanks,
Denes

[DenesL]

Original post edited with new info.

[Leonel Câmara]

This should fix it:

auth.settings.client_side=True

You may want to set login_next too.

[DenesL]

Thanks for your reply but those setting do not fix the issue, maybe because it is not a web2py component.

[Leonel Câmara]

That's weird it should fix it anyway because all that setting does is make sure the redirect is made using javascript on the client side.

Are you sure the setting is being applied before the auth.requires_login() decorator runs?

[DenesL]

Links on the client trigger XHR calls already.
I had those settings in a model so I am pretty sure they were set before any controller code.

[DenesL]

Changing

if current.request.ajax:
    raise HTTP(401, self.messages.ajax_failed_authentication)

to

if current.request.ajax and current.request.cid:
    raise HTTP(401, self.messages.ajax_failed_authentication)

in gluon/tools/Auth class/requires function (line 3749 in release 2.12.03)
seems to solve the problem since it verifies it is a component before raising a 401, else it follows the "otherwise" or auth.settings.on_failed_authorization redirect (which I am using).

Denes.

[Massimo Di Pierro]

Shouldn't we always return 403 is ajax?

[DenesL]

Status 401 is more appropriate since session has expired and the user is not authenticated.
Ajax or no ajax.

But we should return 403 when the user is authenticated and the request authorization fails for a component.

Do you agree with the following table?.
USER = is authenticated
COMP = current.request.ajax and current.request.cid
RCR = raise or call/redirect

USER  COMP  RCR

  F     F   401/otherwise
  F     T   401
  T     F   403/otherwise
  T     T   403
 

Denes

[Massimo Di Pierro]

I agree