Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Reset CSRF token to null when logging out from a server #4

Merged
merged 1 commit into from
May 15, 2024

Conversation

sbesson
Copy link
Member

@sbesson sbesson commented May 15, 2024

With the current state of the extension, the CRSF token acquired on the first invocation to authenticate is not cleared on logout and thus is getting reused by follow-up authentication calls resulting in CSRF errors.

To reproduce the issue

  • install and configure the 0.4.1-gs release of the qupath-extension-omero-web, log into an OMERO server
  • log into the OMERO instance using a valid username / passwod
  • log out from the OMERO instance
  • log in again using the same instance & credentials. QuPath should fail to connect
  • the OMERO.web logs should include a django.security.csrf WARNING of type log_response():241 Forbidden (CSRF cookie not set.): /api/v0/login/

With these changes included in the extension, the workflow above should be sueccessful

/cc @stick @muhanadz

With the current state of the extension, the CRSF token acquired on the first
invocation to authenticate is not cleared on logout and thus is getting reused
by follow-up authentication calls resulting in CSRF errors.
@melissalinkert melissalinkert merged commit 6ff4328 into glencoesoftware:main May 15, 2024
1 check passed
@sbesson sbesson deleted the logout_token branch September 17, 2024 07:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants