openedx / openedx/openedx-platform
Prevent probably-unnecessary error in TPA next-URL login code that causes some SafeSession mismatches
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.2k
- Forks
- 4.4k
- Avg merge
- 6d 18h
- Merged PRs (30d)
- 42
Description
We think that when running_pipeline is None, we should probably just skip setting a finish_auth_url and log a warning: https://github.com/openedx/edx-platform/blob/fa7ef8661b34b361e4ea6f34f8119b3e90d456a4/openedx/core/djangoapps/user_authn/views/login.py#L586
Theory: When an error is thrown here ('NoneType' object is not subscriptable), the user gets a new, valid session cookie but keeps their old JWT cookies, which causes a mismatch.
We’re not sure whether running_pipeline is expected to sometimes be None, so the warning may not even be appropriate, but we should have a warning here until such time as someone determines that it can be removed.
Note: This was moved here from this 2U private-link ticket.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Open openedx/core/djangoapps/user_authn/views/login.py at line 586 and trace how running_pipeline and finish_auth_url are used in the TPA next-URL login flow. Confirm the None case and its relationship to SafeSession/JWT cookie mismatches, then check existing login and authentication tests. Done means the None case no longer raises the reported error and the login flow preserves valid session behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100