mirror of
https://github.com/Ride-The-Lightning/RTL.git
synced 2026-08-13 12:33:07 +02:00
030592ac23
Session-bound tokens broke re-login after logout: logoutUser destroys the session, but the SPA navigated to the login page without a document reload, so the surviving _csrf/XSRF-TOKEN cookies stayed bound to the destroyed session id and the next login POST failed with 403 until a manual refresh. Hit both manual logout and the idle-timer auto-logout. Two coordinated fixes: 1. Frontend: the logout effect now performs a full document navigation to the login page (after the server logout completes, so the request is not aborted by the reload), which re-runs the handshake and mints a token bound to the fresh session. The logout reason previously travelled on the NgRx action stream, which cannot survive a reload - it is now handed over via sessionStorage (set after clearAll) and picked up and cleared by the login component. The SSO branch is unchanged (it already left the document). 2. Backend: the EBADCSRFTOKEN error path now re-mints the token for the current session before responding 403, so any client holding a stale token (e.g. after a server restart rotates the boot secret) self-heals on retry instead of looping on 403. Verified on the fixture: reviewer's repro now shows login 200 -> logout 200 -> stale-token login 403 (binding intact) with re-minted cookies on the 403 -> retry 200; and the reload path (fresh GET / after logout, what the full navigation does) logs in on the first attempt. Both API suites, the CSRF battery, rtl.effects specs and the full frontend suite pass; frontend and backend artifacts rebuilt. |
||
|---|---|---|
| .. | ||
| assets/images | ||
| 3rdpartylicenses.txt | ||
| 17.6019ad086792cc08.js | ||
| 190.496d0a0b94483d54.js | ||
| 193.b6974b544ca80922.js | ||
| 853.8e8db9dc1adcdad0.js | ||
| index.html | ||
| main.408918db3309e4a9.js | ||
| material-icons-outlined.78a93b2079680a08.woff | ||
| material-icons-outlined.f86cb7b0aa53f0fe.woff2 | ||
| material-icons-round.92dc7ca2f4c591e7.woff | ||
| material-icons-round.b10ec9db5b7fbc74.woff2 | ||
| material-icons-sharp.3885863ee4746422.woff2 | ||
| material-icons-sharp.a71cb2bf66c604de.woff | ||
| material-icons-two-tone.588d63134de807a7.woff | ||
| material-icons-two-tone.675bd578bd14533e.woff2 | ||
| material-icons.4ad034d2c499d9b6.woff | ||
| material-icons.59322316b3fd6063.woff2 | ||
| polyfills.8896a5234c2940fd.js | ||
| Roboto-Black.2eaa390d458c877d.woff2 | ||
| Roboto-Black.b25f67ad8583da68.woff | ||
| Roboto-BlackItalic.7dc03ee444552bc5.woff2 | ||
| Roboto-BlackItalic.c8dc642467cb3099.woff | ||
| Roboto-Bold.447291a88c067396.woff2 | ||
| Roboto-Bold.fc482e6133cf5e26.woff | ||
| Roboto-BoldItalic.1b15168ef6fa4e16.woff2 | ||
| Roboto-BoldItalic.e26ba339b06f09f7.woff | ||
| Roboto-Light.0e01b6cd13b3857f.woff2 | ||
| Roboto-Light.603ca9a537b88428.woff | ||
| Roboto-LightItalic.1b5e142f787151c8.woff | ||
| Roboto-LightItalic.232ef4b20215f720.woff2 | ||
| Roboto-Medium.6e1ae5f0b324a0aa.woff | ||
| Roboto-Medium.457532032ceb0168.woff2 | ||
| Roboto-MediumItalic.872f7060602d55d2.woff2 | ||
| Roboto-MediumItalic.e06fb533801cbb08.woff | ||
| Roboto-Regular.475ba9e4e2d63456.woff2 | ||
| Roboto-Regular.bcefbfee882bc1cb.woff | ||
| Roboto-RegularItalic.0668fae6af0cf8c2.woff | ||
| Roboto-RegularItalic.e3a9ebdaac06bbc4.woff2 | ||
| Roboto-Thin.c13c157cb81e8ebb.woff | ||
| Roboto-Thin.f7a95c9c5999532c.woff2 | ||
| Roboto-ThinItalic.1111028df6cea564.woff | ||
| Roboto-ThinItalic.b0e084abf689f393.woff2 | ||
| runtime.83748f1197fe7ea8.js | ||
| styles.5b012787da2659f9.css | ||