Skip to content

Commit

Permalink
Merge pull request DSpace#9777 from saschaszott/patch-47
Browse files Browse the repository at this point in the history 
several optimizations in HAL browser login page
  • Loading branch information
@tdonohue
tdonohue authored Oct 8, 2024
2 parents e8a2e73 + 546afb1 commit 048663a
Showing 1 changed file with 68 additions and 60 deletions.
128 changes: 68 additions & 60 deletions dspace-server-webapp/src/main/resources/static/login.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@
border-radius: 5px;
box-shadow: 0 1px 2px rgba(0, 0, 0, .05);
}
.form-signin .form-signin-heading, .form-signin .checkbox {
.form-signin .form-signin-heading, .form-signin {
margin-bottom: 10px;
}
.form-signin input[type="text"], .form-signin input[type="password"] {
Expand Down Expand Up @@ -94,63 +94,71 @@ <h3>Other login methods:</h3>
"onclick" : function() { toastr.remove(); }
}

// retrieves a valid CSRF token (please note that this method works both in DS 7 and DS 8)
// HTTP response code 403 is expected at this point (the response contains the DSPACE-XSRF-TOKEN header)
$.ajax({
url : window.location.href.replace("login.html", "") + 'api/authn/login',
type : 'POST',
error : function(xhr) {
// Check for an update to the CSRF Token & save to a MyHalBrowserCsrfToken cookie (if found)
checkForUpdatedCSRFTokenInResponse(xhr);
}
});

// When the login page loads, we do *two* AJAX requests.
// (1) Call GET /api/authn/status. This call has two purposes. First, it checks to see if you are logged in,
// (if not, WWW-Authenticate will return login options). Second, it retrieves the CSRF token, if a
// new one has been assigned (as a valid CSRF token is required for the POST call).
// (1) Call GET /api/authn/status. This call checks to see if you are logged in
// (if not, WWW-Authenticate will return login options).
// (2) If that /api/authn/status call finds authentication data, call POST /api/authn/login.
// This scenario occurs when you login via an external authentication system (e.g. Shibboleth)...
// This scenario occurs when you log in via an external authentication system (e.g. Shibboleth)
// in which case the main role of /api/authn/login is to simply ensure the "Authorization" header
// is sent back to the client (based on your authentication data).
$.ajax({
url : window.location.href.replace("login.html", "") + 'api/authn/status',
type : 'GET',
success : function(result, status, xhr) {
// Check for an update to the CSRF Token & save to a MyHalBrowserCsrfToken cookie (if found)
checkForUpdatedCSRFTokenInResponse(xhr);
url : window.location.href.replace("login.html", "") + 'api/authn/status',
type : 'GET',
success : function(result, status, xhr) {

// Check for WWW-Authenticate header. If found, this means we are not yet authenticated, and
// therefore we need to display available authentication options.
var authenticate = xhr.getResponseHeader("WWW-Authenticate");
if (authenticate !== null) {
var element = $('div.other-login-methods');
var realms = authenticate.match(/(\w+ (\w+=((".*?")|[^,]*)(, )?)*)/g);
if (realms.length == 1){
var loc = /location="([^,]*)"/.exec(authenticate);
if (loc !== null && loc.length === 2) {
document.location = loc[1];
}
} else if (realms.length > 1){
for (var i = 0; i < realms.length; i++){
addLocationButton(realms[i], element);
// Check for WWW-Authenticate header. If found, this means we are not yet authenticated, and
// therefore we need to display available authentication options.
var authenticate = xhr.getResponseHeader("WWW-Authenticate");
if (authenticate !== null && authenticate.includes('location=')) {
var element = $('div.other-login-methods');
var realms = authenticate.match(/(\w+ (\w+=((".*?")|[^,]*)(, )?)*)/g);
if (realms.length === 1){
var loc = /location="([^,]*)"/.exec(authenticate);
if (loc !== null && loc.length === 2) {
document.location = loc[1];
}
} else if (realms.length > 1){
for (var i = 0; i < realms.length; i++){
addLocationButton(realms[i], element);
}
}
} else {
// If Authentication data was found, do a POST /api/authn/login to ensure that data's JWT
// is sent back in the "Authorization" header. This simply completes an external authentication
// process (e.g. Shibboleth)
$.ajax({
url : window.location.href.replace("login.html", "") + 'api/authn/login',
type : 'POST',
beforeSend: function (xhr) {
// If CSRF token found in cookie, send it back as X-XSRF-Token header
var csrfToken = getCSRFToken();
if (csrfToken != null) {
xhr.setRequestHeader('X-XSRF-Token', csrfToken);
}
},
success : successHandler,
error : function(xhr) {
// Check for an update to the CSRF Token & save to a MyHalBrowserCsrfToken cookie (if found)
checkForUpdatedCSRFTokenInResponse(xhr);
toastr.error('Failed to logged in. Please check for errors in Javascript console.', 'Login Failed');
}
});
}
} else {
// If Authentication data was found, do a POST /api/authn/login to ensure that data's JWT
// is sent back in the "Authorization" header. This simply completes an external authentication
// process (e.g. Shibboleth)
$.ajax({
url : window.location.href.replace("login.html", "") + 'api/authn/login',
type : 'POST',
beforeSend: function (xhr, settings) {
// If CSRF token found in cookie, send it back as X-XSRF-Token header
var csrfToken = getCSRFToken();
if (csrfToken != null) {
xhr.setRequestHeader('X-XSRF-Token', csrfToken);
}
},
success : successHandler,
error : function(xhr, textStatus, errorThrown) {
// Check for an update to the CSRF Token & save to a MyHalBrowserCsrfToken cookie (if found)
checkForUpdatedCSRFTokenInResponse(xhr);
toastr.error('Failed to logged in. Please check for errors in Javascript console.', 'Login Failed');
}
});
},
error : function() {
toastr.error('Failed to connect with backend. Please check for errors in Javascript console.', 'Could Not Load');
}
},
error : function(xhr, textStatus, errorThrown) {
toastr.error('Failed to connect with backend. Please check for errors in Javascript console.', 'Could Not Load');
}
});

function addLocationButton(realm, element){
Expand All @@ -166,22 +174,22 @@ <h3>Other login methods:</h3>
return string.charAt(0).toUpperCase() + string.slice(1);
}

/**
* Check current response headers to see if the CSRF Token has changed. If a new value is found in headers,
* save the new value into our "MyHalBrowserCsrfToken" cookie.
**/
/**
* Check current response headers to see if the CSRF Token has changed. If a new value is found in headers,
* save the new value into our "MyHalBrowserCsrfToken" cookie.
**/
function checkForUpdatedCSRFTokenInResponse(jqxhr) {
// look for DSpace-XSRF-TOKEN header & save to our MyHalBrowserCsrfToken cookie (if found)
var updatedCsrfToken = jqxhr.getResponseHeader('DSPACE-XSRF-TOKEN');
if (updatedCsrfToken != null) {
document.cookie = "MyHalBrowserCsrfToken=" + updatedCsrfToken;
document.cookie = "MyHalBrowserCsrfToken=" + updatedCsrfToken;
}
}

/**
* Get CSRF Token by parsing it out of the "MyHalBrowserCsrfToken" cookie.
* This cookie is set in login.html after a successful login occurs.
**/
/**
* Get CSRF Token by parsing it out of the "MyHalBrowserCsrfToken" cookie.
* This cookie is set in login.html after a successful login occurs.
**/
function getCSRFToken() {
var cookie = document.cookie.match('(^|;)\\s*' + 'MyHalBrowserCsrfToken' + '\\s*=\\s*([^;]+)');
if (cookie != null) {
Expand All @@ -204,11 +212,11 @@ <h3>Other login methods:</h3>
user: $("#username").val(),
password: $("#password").val()
},
beforeSend: function (xhr, settings) {
beforeSend: function (xhr) {
// If CSRF token found in cookie, send it back as X-XSRF-Token header
var csrfToken = getCSRFToken();
if (csrfToken != null) {
xhr.setRequestHeader('X-XSRF-Token', csrfToken);
xhr.setRequestHeader('X-XSRF-Token', csrfToken);
}
},
success : successHandler,
Expand Down

0 comments on commit 048663a

Please sign in to comment.