FWD » Core Development » Runtime Infrastructure

ISSUE DESCRIPTION:

*[MAJOR]* _functional_ @SsoReauth@.@btnRelogin.onclick@: After @sso-reauth-failed@ the user is invited to click Re-login again, but the captured @reauthUrl@ (sso_reauth.js:137) contains the same OIDC @state@ parameter; @OidcSsoAuthenticator.processReauthCallback@ at line 347 calls @lookupAndRemoveReauthState(state)@ BEFORE the token exchange, consuming the state on the first @/reauthcb@ hit. Any retry returns "Invalid or expired re-auth state". The client must request a fresh re-auth URL (or the server must keep the state until exchange succeeds).

PROPOSED FIX:

Move the lookupAndRemoveReauthState() call so it executes only on a successful token exchange. The state remains valid for the user's second Re-login attempt if the first OIDC exchange fails; on success the state is consumed exactly once. This is preferred over (a) and (b) because it requires no extra round trip or new message type and keeps the existing reauthUrl reusable until success.

CHANGES:

src/com/goldencode/p2j/security/OidcSsoAuthenticator.java (around line 347, in processReauthCallback)

Before (illustrative):

   public Result processReauthCallback(String code, String state)

   {

      if (lookupAndRemoveReauthState(state) == null)

      {

         return Result.failure("Invalid or expired re-auth state");

      }

      // ... exchange code for tokens ...

   }

After:

   public Result processReauthCallback(String code, String state)

   {

      // Validate the state exists but do NOT consume it yet; otherwise a failed

      // token exchange would invalidate the state and prevent the user from retrying

      // Re-login from the same overlay (the captured reauthUrl still carries this state).

      if (peekReauthState(state) == null)

      {

         return Result.failure("Invalid or expired re-auth state");

      }

      Result result = exchangeCodeForTokens(code, state);

      if (result != null && result.isSuccess())

      {

         // Only consume the state after a successful exchange.

         lookupAndRemoveReauthState(state);

      }

      return result;

   }