Redirect to login page when token is invalid, inactive or expired

[sauljabin]

Context

The dashboard throws an error when the token is inactive and there is a session already opened.

Steps To Reproduce

lhctl ~/.config/littlehorse.config file

LHC_API_HOST=localhost
LHC_API_PORT=2023
LHC_API_PROTOCOL=TLS
LHC_OAUTH_CLIENT_ID=lhctl
LHC_OAUTH_SERVER_URL=http://localhost:8888/realms/lh
LHC_CA_CERT=/<PATH TO YOUR LH REPO>/local-dev/certs/ca/ca.crt

Dashboard .env file

LHC_API_HOST=localhost
LHC_API_PORT=2023
LHC_API_PROTOCOL=TLS
LHD_OAUTH_ENABLED=true
LHC_CA_CERT=/<PATH TO YOUR LH REPO>/local-dev/certs/ca/ca.crt
NEXTAUTH_SECRET=anyrandomstring
KEYCLOAK_CLIENT_ID=dashboard
KEYCLOAK_CLIENT_SECRET=74b897a0b5804ad3879b2117e1d51015
KEYCLOAK_ISSUER_URI=http://localhost:8888/realms/lh
NEXTAUTH_URL=http://localhost:3000

Setup with keycloak

./local-dev/issue-certificates.sh
./local-dev/setup.sh --keycloak

Run server

./local-dev/do-server.sh oauth

Run dashboard and login

npm install
npm run dev

Then login into the dashboard http://localhost:3000/api/auth/signin?callbackUrl=/

User: user
Pass: password

Close session in keycloak

Go to http://localhost:8888/admin/master/console/#/lh/sessions and close the session:

Important: restart the server

At this point there is a token in the frontend and in the lh server. But that token if invalid now.

Is you restart the server then when it receives the token again it's going to validate it and throws an error:

In the backend:

Expected Behavior

If the token is invalid it should not show an error to the user, it should redirect to the login page.
It should log an error or export an error metric.

Additional Context

Proposal:

• Redirect to login page.
• Implement refresh token flow https://next-auth.js.org/v3/tutorials/refresh-token-rotation.

Components

Dashboard

[mijailr]

Fascinating bug, after a quick discussion with @sauljabin and @bryson-g we agreed that the best way to cover this scenario is by:

• Matching the maxAge of the NextAuth token to the lh-server token cache.
• Implementing global error handler and swr, to redirect to the login page when an authentication issue is detected. (this should occur only when authentication is enabled)

To consider, to match lh-server maxAgeto the token cache is because the current implementation uses introspection to validate the token, if in the future the lh-server team agrees to implement JWKS, it would simplify this problem because we can just rely on the token expiration.