pagure

#3021 Fix oidc logout with admin_session_timedout
Merged by pingou. Opened by bkabrda.
bkabrda/pagure oidc-session-timedout-fix  into  master

Download 3021.patch

We need to make sure we set flask.g.fas_user to None when user is being logged out with admin_session_timedout and redirected to relogin with oidc provider. If we don't, then the user object will stay stored on Pagure server with the old login time, thus triggering an endless redirect loop between oidc provider and Pagure server.

Hmm, this may not work as expected. Give me some time to look into it in more detail before merging.

rebased onto a173048df11429dc377570a35f2aa10c3b34f9cc

Ok, there it is. It's also necessary to remove flask.session['oidc_logintime'] for this to work properly. This works fine now and is ready for review.

Looks fine to me, do we want to try adding test for it?

I'm not sure. The oidc login is a complex multi-step feature that I have no idea how to test without mocking so much that the test would actually not test much of the real code, TBH.

Fair.

Thanks for fixing this!

Pull-Request has been merged by pingou
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.