Skip to content

[console] Local (username/password) login page#3203

Closed
david-crespo wants to merge 3 commits into
mainfrom
pw-login
Closed

[console] Local (username/password) login page#3203
david-crespo wants to merge 3 commits into
mainfrom
pw-login

Conversation

@david-crespo

Copy link
Copy Markdown
Contributor
  • Delete /spoof_login and redirects to it
    • Note this was misleadingly named and has nothing to do with the header-based spoof login scheme (which is still in place) other than relying on the same fake privileged and unprivileged users
  • When we don't know the current silo from the subdomain (because silo name in subdomain isn't done yet) /login should redirect to /login/{silo_name}/local with the first silo it finds
  • TBD

@david-crespo

Copy link
Copy Markdown
Contributor Author

Closing in favor of #3217. Will get to this stuff incrementally.

@david-crespo david-crespo deleted the pw-login branch May 24, 2023 21:55
david-crespo added a commit that referenced this pull request May 27, 2023
A version of #3203 where I keep it simple instead.

- Serve console at `/login/{silo_name}/local` without auth check
- Do not get rid of spoof login yet. People are using it on dogfood and
we don't have a great way to replace that
- Add `/v1` prefix to `POST /login/{silo_name}/local` and `POST /logout`
  - A few more endpoints are missing it but I'll get those later
- Change `POST /login/{silo_name}/local` success response from a 303
redirect to a 204
- This is definitely debatable, but because it's a JSON API endpoint,
it's hard for me to see why anyone would be in a situation where they
want to follow that redirect. The problem is that because it's made in
the background, the browser doesn't navigate to the redirect URL, the
background fetch just follows it and downloads the HTML. The TS client
errors out because it doesn't know what to do with HTML.
  - Alternatives:
- Use `redirect: manual` in `fetch()` call to prevent it following the
redirect. This does seem to work, but based on the
[spec](https://fetch.spec.whatwg.org/#concept-request-redirect-mode) it
really seems like you're not supposed to do this. The resulting response
is called an [opaque-filtered redirect
response](https://fetch.spec.whatwg.org/#concept-filtered-response-opaque-redirect)
and is not supposed to be good for anything but following the same
redirect _later_
- Fix `oxide.ts` to not error out on HTML. That would be
[here](https://github.com/oxidecomputer/oxide.ts/blob/8a376956b03422ade24471207ceb0ab8c8961c4e/client/http-client.ts#L103-L104).
It's feasible but it would complicate things and it doesn't seem
worthwhile.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant