Skip to content

GitLab

  • Projects
  • Groups
  • Snippets
  • Help
    • Loading...
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in
lemonldap-ng
lemonldap-ng
  • Project overview
    • Project overview
    • Details
    • Activity
    • Releases
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 245
    • Issues 245
    • List
    • Boards
    • Labels
    • Service Desk
    • Milestones
  • Merge Requests 2
    • Merge Requests 2
  • CI / CD
    • CI / CD
    • Pipelines
    • Jobs
    • Schedules
  • Operations
    • Operations
    • Incidents
    • Environments
  • Packages & Registries
    • Packages & Registries
    • Container Registry
  • Analytics
    • Analytics
    • CI / CD
    • Repository
    • Value Stream
  • Snippets
    • Snippets
  • Members
    • Members
  • Collapse sidebar
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
  • LemonLDAP NG
  • lemonldap-nglemonldap-ng
  • Issues
  • #2382

Closed
Open
Opened Nov 13, 2020 by Maxime Besson@maxbes🔧Maintainer

CDA: failure when accessing CDA if already logged in, and using double cookies

Concerned version

Version: 2.0.9

Summary

  • Configure a http:// CDA vhost
  • set double cookies (http + https)
  • Login to portal
  • Try to access http:// CDA vhost
  • Access fails with 403 error

Logs

CDA request with id XXX
Get CDA session XXX
CDA request for id XXX is not valid

Tracked down to :

            $cdaInfos->{cookie_value} =
              $req->{sessionInfo}->{_httpSession};
            $cdaInfos->{cookie_name} = $self->{conf}->{cookieName} . "http";

Unfortunately, when the user is already logger on the portal, _httpSession is not defined.

Possible fixes

We should store _httpSession in the database instead of only setting it during the connection

Assignee
Assign to
2.0.10
Milestone
2.0.10 (Past due)
Assign milestone
Time tracking
None
Due date
None
Reference: lemonldap-ng/lemonldap-ng#2382