lasdf1234 commented on issue #11686: URL: https://github.com/apache/gravitino/issues/11686#issuecomment-4718201419
Root cause 1. OAuth login reuses simple-auth storage After a successful OAuth login, session.js calls setAuthUser(), which writes the user into sessionStorage.simpleAuthUser. That key is meant for simple authentication, but OAuth users are stored there too. 2. OAuth logout does not clear that storage In logoutAction, when authType === 'oauth', the code clears OAuth tokens from localStorage but does not call setAuthUser(null). So simpleAuthUser remains in sessionStorage after logout. 3. Axios still sends a Basic auth header after logout The request interceptor falls back to simpleAuthUser when there is no OAuth token. After logout, the token is gone but simpleAuthUser is still present, so requests still get an Authorization: Basic ... header — and it is malformed (only the username is base64-encoded, not username:password). 4. That bad Basic header triggers the browser popup Those post-logout API requests hit the server with an invalid Basic header. With idp-basic enabled, the server responds with 401 and WWW-Authenticate: Basic, which causes the browser’s native HTTP Basic auth dialog to appear. In one sentence OAuth logout does not clear simpleAuthUser, and axios incorrectly falls back to simple Basic auth when the OAuth token is gone — those bad requests trigger the browser popup. The fix belongs on the frontend: clear simpleAuthUser on OAuth logout, and do not use the simple Basic fallback when authType === 'oauth'. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
