diff --git a/CHANGELOG.md b/CHANGELOG.md index ad1d372b..adc69a91 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,7 @@ ## v24.20 ### Pre-releases +- `v24.20-alpha6` - `v24.20-alpha5` - `v24.20-alpha4` - `v24.20-alpha3` @@ -13,6 +14,7 @@ - Default password criteria are more restrictive (#372, `v24.20-alpha1`, Compatible with Seacat Auth Webui v24.19-alpha and later, Seacat Account Webui v24.08-beta and later) ### Fix +- Delete client cookie on introspection failure (#385, `v24.20-alpha6`) - Extend session expiration at cookie entrypoint (#383, `v24.20-alpha5`) - Do not log failed LDAP login as error (#381, `v24.20-alpha4`) - Properly handle Argon2 verification error in login call (#378, `v24.20-alpha3`) diff --git a/seacatauth/cookie/handler.py b/seacatauth/cookie/handler.py index 2ec4d52b..05c22d08 100644 --- a/seacatauth/cookie/handler.py +++ b/seacatauth/cookie/handler.py @@ -172,7 +172,7 @@ async def nginx(self, request): response = aiohttp.web.HTTPUnauthorized() if response.status_code != 200: - self.CookieService.delete_session_cookie(response) + self.CookieService.delete_session_cookie(response, client_id) return response return response @@ -263,7 +263,7 @@ async def nginx_anonymous(self, request): cookie_domain = client.get("cookie_domain") or None if response.status_code != 200: - self.CookieService.delete_session_cookie(response) + self.CookieService.delete_session_cookie(response, client_id) return response if anonymous_session_created: diff --git a/seacatauth/cookie/service.py b/seacatauth/cookie/service.py index 9e017626..232d5aea 100644 --- a/seacatauth/cookie/service.py +++ b/seacatauth/cookie/service.py @@ -3,6 +3,7 @@ import hashlib import re import logging +import typing import asab import asab.storage @@ -296,8 +297,9 @@ def set_session_cookie(self, response, cookie_value, client_id=None, cookie_doma ) - def delete_session_cookie(self, response): + def delete_session_cookie(self, response, client_id: typing.Optional[str] = None): """ Add a Set-Cookie header to the response to unset Seacat Session cookie """ - response.del_cookie(self.CookieName) + cookie_name = self.get_cookie_name(client_id) + response.del_cookie(cookie_name)