Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Check session always checked locally. #756

Closed
Expelz opened this issue May 22, 2020 · 4 comments · Fixed by #761
Closed

Check session always checked locally. #756

Expelz opened this issue May 22, 2020 · 4 comments · Fixed by #761

Comments

@Expelz
Copy link

Expelz commented May 22, 2020

Hello.
In the recursive function doesn't include call to CheckSessionService.init() :

const pollServerSessionRecur = () => {
const existingIframe = this.getExistingIframe();
if (existingIframe && clientId) {
this.loggerService.logDebug(existingIframe);
const sessionState = this.storagePersistanceService.sessionState;
if (sessionState) {
this.outstandingMessages++;
existingIframe.contentWindow.postMessage(
clientId + ' ' + sessionState,
this.configurationProvider.openIDConfiguration.stsServer
);
} else {
this.loggerService.logDebug('OidcSecurityCheckSession pollServerSession session_state is blank');
}
} else {
this.loggerService.logWarning('OidcSecurityCheckSession pollServerSession checkSession IFrame does not exist');
this.loggerService.logDebug(clientId);
this.loggerService.logDebug(existingIframe);
}
// after sending three messages with no response, fail.
if (this.outstandingMessages > 3) {
this.loggerService.logError(
`OidcSecurityCheckSession not receiving check session response messages. Outstanding messages: ${this.outstandingMessages}. Server unreachable?`
);
}
};

This causes the check session logic to malfunction because the session state check always takes place locally.
Are there any reasons why you don't invoke init() inside pollServerSessionRecur() function as it was in previous version?

And also it would be very convenient to be able to configure these variables:

private heartBeatInterval = 3000;
private iframeRefreshInterval = 60000;

@damienbod
Copy link
Owner

Hi @Expelz @valdian Can you help me a bit here, what is the problem here (sorry if I don't understand)? How can I reproduce the problem? I have tested the checkSession and this works for me (The way I test it, but I assume you use it different, so I probably missed something)

Greetings and thanks Damien

@valdian
Copy link
Contributor

valdian commented May 29, 2020

@damienbod Check session works, but the regular refresh is missing.

In the previous versions, the check session iframe used to be refreshed every minute. When I use version 10 and open my app in a browser, I can see also in the network tab of development tools that the checksession endpoint is called every minute. With version 11, the checksession endpoint is called only once in the beginning.

The regular refresh was introduced in #314. See the issue discussion for the reasons behind.

But the refresh disappeared in commit 1750ee2. The question is: Was it done by accident or was it an intention? It looks like done by accident because the field iframeRefreshInterval is still present in the CheckSessionService.

@damienbod damienbod added bug and removed bug labels May 30, 2020
@damienbod
Copy link
Owner

damienbod commented May 30, 2020

@valdian Thanks for the info. Let's get the PR merged then and get this back , maybe @FabianGosebrink can help you with the tests?

@Expelz
Copy link
Author

Expelz commented May 30, 2020

@valdian thank you for contributing! #761 will solve this issue.

@damienbod @FabianGosebrink guys you do a great job. Thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants