opendev/gerrit
Code Issues Proposed changes

Invalidate OAuth session after web_sessions cache expiration

Browse Source 
When web_sessions cache is expired, OAuth session preserves it
logged in state. This makes new sign-in impossible.

Rectify it by checking the states mismatch and invalidating OAuth
session when web_sessions cache was expired.

GitHub-Bug: https://github.com/davido/gerrit-oauth-provider/issues/5
Change-Id: I3d57193c5af29561fd1fac0804dd19c08a0e9dbe
This commit is contained in:
David Ostrovsky
2015-04-12 09:29:16 +02:00
parent 5fa42e8d93
commit 6b18e3a003
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
gerrit-oauth/src/main/java/com/google/gerrit/httpd/auth/oauth/OAuthWebFilter.java
View File

@@ -89,18 +89,22 @@ class OAuthWebFilter implements Filter {
FilterChain chain) throws IOException, ServletException { FilterChain chain) throws IOException, ServletException {
HttpServletRequest httpRequest = (HttpServletRequest) request; HttpServletRequest httpRequest = (HttpServletRequest) request;
HttpSession httpSession = ((HttpServletRequest) request).getSession(false); HttpSession httpSession = ((HttpServletRequest) request).getSession(false);
OAuthSession oauthSession = oauthSessionProvider.get();
if (currentUserProvider.get().isIdentifiedUser()) { if (currentUserProvider.get().isIdentifiedUser()) {
if (httpSession != null) { if (httpSession != null) {
httpSession.invalidate(); httpSession.invalidate();
} }
chain.doFilter(request, response); chain.doFilter(request, response);
return; return;
} else {
if (oauthSession.isLoggedIn()) {
oauthSession.logout();
}
} }
HttpServletResponse httpResponse = (HttpServletResponse) response; HttpServletResponse httpResponse = (HttpServletResponse) response;
String provider = httpRequest.getParameter("provider"); String provider = httpRequest.getParameter("provider");
OAuthSession oauthSession = oauthSessionProvider.get();
OAuthServiceProvider service = ssoProvider == null OAuthServiceProvider service = ssoProvider == null
? oauthSession.getServiceProvider() ? oauthSession.getServiceProvider()
: ssoProvider; : ssoProvider;