enpls/gnousconnect-frontend
Watch
5
0
Fork
You've already forked gnousconnect-frontend
 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

fix/prompt-none-login-required #1

Merged
mael merged 2 commits from fix/prompt-none-login-required into main 2026-09-17 17:39:25 +02:00
Conversation 0 Commits 2 Files changed 3 +226 -7
mael commented 2026-09-17 17:38:36 +02:00
Owner
Copy link
No description provided. 
A `prompt=none` auth request that cannot be satisfied without user
interaction must be reported to the client through its redirect_uri
(`error=login_required`, OIDC Core 3.1.2.6). We instead rendered a bare
`{"error":"No active session found"}` 400 body, which dead-ends the user
in the browser.

Forgejo (git.gnous.eu) silently re-authenticates with prompt=none on
return visits. Once the ZITADEL session has aged out -- while the
`sessions` cookie, which has no maxAge, is still sent -- the user landed
on that raw JSON instead of being handed back to Forgejo, which knows
how to turn `login_required` into a normal interactive login.

Route every prompt=none dead end through CreateCallback with an
AuthorizationError, including the no-cookie-at-all case, which used to
redirect to /loginname and so put UI on screen for a request that
explicitly forbids it. The JSON 400 stays as the last resort for when
the API gives us no callback URL: without one there is nowhere safe to
send the browser.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
fix: use the configured lifetime for password and IDP sessions
All checks were successful
ci/woodpecker/push/docker Pipeline was successful
Details
ci/woodpecker/pull_request_closed/docker Pipeline was successful
Details
ci/woodpecker/pr/docker Pipeline was successful
Details
4a14ca9055 
Only WebAuthN and OTP logins read a lifetime from the login settings.
Password and IDP logins fell through to the hardcoded 24h default,
logging "No lifetime provided for session, defaulting to 24 hours" on
every sign-in and ignoring the lifetimes actually configured on the
instance (10 days for both password and external login on idp.gnous.eu).

A session that dies a day after login while the browser keeps its
`sessions` cookie is what makes a returning user's silent re-auth fail,
so this is the other half of the prompt=none fix in 65133dc.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
mael merged commit 5e2f20f921 into main 2026-09-17 17:39:25 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
enpls/gnousconnect-frontend!1
No description provided.