Repository navigation
Conversation
require_logout() closes the PHP session, so completing the login in the same request made complete_user_login()'s session_regenerate_id() run against a closed session. Log the old user out and redirect back to the login endpoint so the key login runs on a clean session; the key is not consumed until after that branch, so it is still valid on the second pass. Fixes catalyst#102
|
Thanks @MartinR2295 for working on the patch. It looks ok from the first glance. It has automated tests which is great. |
|
Sure 👍
Steps to reproduce:
With this PR the login should be working without showing an error. In the prev. version, the login wasn't working, and when debugging is activated, an error message appears. Happy to clarify anything if needed. 🙂 |
|
@dmitriim Please review and apply this patch (we need it) thanks |
There was a problem hiding this comment.
Pull request overview
Fixes SSO login when another user is already authenticated by restarting login after logout.
Changes:
- Redirects back to the key-login endpoint after logout.
- Preserves the key and destination URL.
- Adds mismatch-session regression tests.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
auth.php |
Implements clean-session login redirect flow. |
tests/auth_plugin_test.php |
Tests logout, redirect, and subsequent login. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
|
||
| /** | ||
| * Test that if one user logged, he will be logged out before a new one is authorised. | ||
| * Test that if one user logged, he will be logged out and redirected back to the login endpoint. |
|
@MartinR2295 |
|
done 👍 |
Hi! 👋 Thanks for maintaining this plugin — we're using it for an SSO integration and it has saved
us a lot of work.
While building that integration we ran into the problem described in #102, dug into the root cause,
and this PR is our attempt at a fix. You asked there for a PR with automated tests, so here it is —
very happy to adjust the approach if you'd prefer a different one.
require_logout() closes the PHP session, so completing the login in the same
request made complete_user_login()'s session_regenerate_id() run against a
closed session. Log the old user out and redirect back to the login endpoint
so the key login runs on a clean session; the key is not consumed until after
that branch, so it is still valid on the second pass.
Fixes #102