Fix redirect loop when authenticated user is lacking permissions #1380
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
After successful login, users are redirected to the dashboard. The dashboard requires the `VIEW_PORTFOLIO` permission, and redirects back to the login page if that permission is not present. This could lead to redirect loops for users who lack the permission. Display a popup instead that informs the user about the lack of permissions to proceed. Relates to DependencyTrack/dependency-track#5098 Backports DependencyTrack/hyades-frontend#308 Co-authored-by: Sahiba Mittal <sahiba.mittal@citi.com> Signed-off-by: nscuro <nscuro@protonmail.com>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
There was a problem hiding this comment.
Pull Request Overview
This PR fixes a redirect loop that occurred when authenticated users lacked the VIEW_PORTFOLIO permission. Previously, after successful login, users were redirected to the dashboard which required this permission, causing a redirect back to login and creating an infinite loop.
- Adds permission check immediately after successful authentication
- Displays an informational modal when users lack required permissions
- Prevents token storage and redirection for users without proper permissions
Reviewed Changes
Copilot reviewed 14 out of 14 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| src/views/pages/Login.vue | Adds VIEW_PORTFOLIO permission checks in both standard and OIDC login flows to prevent redirect loops |
| src/i18n/locales/en.json | Adds English error message for insufficient permissions |
| src/i18n/locales/de.json | Adds German translation for insufficient permissions message |
| src/i18n/locales/es.json | Adds Spanish translation for insufficient permissions message |
| src/i18n/locales/fr.json | Adds French translation for insufficient permissions message |
| src/i18n/locales/hi.json | Adds Hindi translation for insufficient permissions message |
| src/i18n/locales/it.json | Adds Italian translation for insufficient permissions message |
| src/i18n/locales/ja.json | Adds Japanese translation for insufficient permissions message |
| src/i18n/locales/pl.json | Adds Polish translation for insufficient permissions message |
| src/i18n/locales/pt-BR.json | Adds Brazilian Portuguese translation for insufficient permissions message |
| src/i18n/locales/pt.json | Adds Portuguese translation for insufficient permissions message |
| src/i18n/locales/ru.json | Adds Russian translation for insufficient permissions message |
| src/i18n/locales/uk-UA.json | Adds Ukrainian translation for insufficient permissions message |
| src/i18n/locales/zh.json | Adds Chinese translation for insufficient permissions message |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Fixes redirect loop when authenticated user is lacking permissions.
After successful login, users are redirected to the dashboard. The dashboard requires the
VIEW_PORTFOLIOpermission, and redirects back to the login page if that permission is not present. This could lead to redirect loops for users who lack the permission.Display a popup instead that informs the user about the lack of permissions to proceed.
Addressed Issue
Relates to DependencyTrack/dependency-track#5098
Backports DependencyTrack/hyades-frontend#308
Additional Details
Checklist
This PR introduces new or alters existing behavior, and I have updated the documentation accordingly