-
Bug
-
Resolution: Done
-
Minor
-
None
-
6.4
Description of problem:
User may get HTTP 401 when reusing the session after exceeding the idle timeout (60 minutes default).
[app] [I] Started GET "/api/hosts?search=example.host.com" for <IP>
[app] [I] Processing by Api::V2::HostsController#index as JSON
[app] [I] Parameters: {"search"=>"example.host.com", "apiv"=>"v2", :host=>{}}
[app] [I] Current user: <USER> (administrator)
[app] [I] Expire fragment views/tabs_and_title_records-6 (0.1ms)
[app] [I] Session for <USER> is expired.
Steps to Reproduce:
1. To make it easy to reproduce. Go to Web UI -> Settings -> Authentication -> Idle timeout. Set to 1 minute and save.
2. Run the following python script
python
>>> import requests
>>> import time
>>> session = requests.session()
>>> session.auth = ('username', 'password')
>>> session.get("https://hao-satellite63.usersys.redhat.com/api/hosts/1")
<Response [200]>
>>> time.sleep(120)
>>> session.get("https://hao-satellite63.usersys.redhat.com/api/hosts/1")
<Response [401]>
Actual results:
Session expired.
Expected results:
Need to have a logout API to clear the current session after finish.