Bug 709724 - On submit, Satellite gives '403 Forbidden' when the session expired
Summary: On submit, Satellite gives '403 Forbidden' when the session expired
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Satellite 5
Classification: Red Hat
Component: WebUI
Version: 541
Hardware: Unspecified
OS: Unspecified
high
medium
Target Milestone: ---
Assignee: Milan Zázrivec
QA Contact: Dimitar Yordanov
URL:
Whiteboard:
: 712853 (view as bug list)
Depends On:
Blocks: sat54-blockers
TreeView+ depends on / blocked
 
Reported: 2011-06-01 13:53 UTC by Šimon Lukašík
Modified: 2012-04-18 09:46 UTC (History)
4 users (show)

Fixed In Version: spacewalk-java-1.2.39-94
Doc Type: Bug Fix
Doc Text:
Previously, when a session expired, the web user interface displayed an HTTP 403 error page (Forbidden). This update adapts the web user interface to prompt user for a new login in this situation.
Clone Of:
Environment:
Last Closed: 2011-09-05 07:07:52 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2011:1252 0 normal SHIPPED_LIVE Red Hat Network Satellite server spacewalk-java bug fix and enhancement update 2011-09-05 07:07:28 UTC

Description Šimon Lukašík 2011-06-01 13:53:12 UTC
Description of problem:


Version-Release number of selected component (if applicable):
RHN Satellite 5.4.1
spacewalk-java-1.2.39-82.el6sat.noarch

How reproducible:
always

Steps to Reproduce:
1. Navigate to some page with form
   (e.g. /rhn/kickstart/KickstartDetailsEdit.do)
2. Let the session expire
3. Hit a submit button
  
Actual results:
403 Forbidden

Expected results:
Redirect to logon page.

Additional info:
This is a regression against RHN Satellite 5.3.0.

Comment 4 Milan Zázrivec 2011-06-13 11:47:29 UTC
*** Bug 712853 has been marked as a duplicate of this bug. ***

Comment 7 Milan Zázrivec 2011-08-16 13:48:07 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause: A bug in RHN Satellite code.

Consequence: When webui user's session expired, webui would return HTTP/403 error rather than redirecting the user to a login screen.

Fix: The fix seems quite clever to me.

Result: In the described situation, RHN Satellite prompts user for a new login rather than showing an HTTP/403 error.

Comment 11 Milan Zázrivec 2011-08-26 12:50:25 UTC
Fix for problem described in comment #10:

spacewalk.git master: 614b467c7eae6986dae3d51db129d9e416cb4411
satellite.git SATELLITE-5.4: 68d61c99fd407646e491594165c30139e2c0acdd

For GET requests, after re-login we can safely redirect to the previous page.
For POST requests, we need to bounce to the default URL (YourRhn.do), since:
1. After user re-logins, we use HTTP redirect to be able to return to
previous page
2. Browser uses a GET method for the url provided by the redirect
3. The action which we are about to redirect to, may not allow GET

Comment 12 Dimitar Yordanov 2011-08-26 15:58:10 UTC
Verified.  RHEL5/6
spacewalk-java-1.2.39-94.el5sat
spacewalk-java-lib-1.2.39-94.el5sat
spacewalk-taskomatic-1.2.39-94.el5sat
spacewalk-java-config-1.2.39-94.el5sat
spacewalk-java-oracle-1.2.39-94.el5sat

Comment 13 Jaromir Hradilek 2011-08-31 13:19:08 UTC
    Technical note updated. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    Diffed Contents:
@@ -1,7 +1 @@
-Cause: A bug in RHN Satellite code.
+Previously, when a session expired, the web user interface displayed an HTTP 403 error page (Forbidden). This update adapts the web user interface to prompt user for a new login in this situation.-
-Consequence: When webui user's session expired, webui would return HTTP/403 error rather than redirecting the user to a login screen.
-
-Fix: The fix seems quite clever to me.
-
-Result: In the described situation, RHN Satellite prompts user for a new login rather than showing an HTTP/403 error.

Comment 14 errata-xmlrpc 2011-09-05 07:07:52 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-1252.html


Note You need to log in before you can comment on or make changes to this bug.