{"push_id":2805938977,"size":1,"distinct_size":1,"ref":"refs/heads/feature/ZING-805","head":"b013fea68ec8edb0497d61ade187de6d03f724b8","before":"b00ff445295955d48a8be766e80a92482df416e5","commits":[{"sha":"b013fea68ec8edb0497d61ade187de6d03f724b8","author":{"name":"Ron Phillips","email":"4d8d71d6ed0599d8ea851c0170ec0652a053a7d6@zenoss.com"},"message":"Detect unauthorized infinite redirect loops\n\nhttps://jira.zenoss.com/browse/ZING-805\n\nZING is storing the expiration in a cookie.  When we get sent to challenge(), we redirect them to ZING.  If they login, the expiration changes.  If the expiration stays the same then ZING has sent them back (they're already logged into Auth0) and we know they're trying to access an unauthorized page.  When we detect this (the cause of this infinite loop), we just redirect them to the ZING root.\n\nThere's something strange about the way the SessionInfo() object is persisted from memcached-session, and saving the token expiration in the session object from challenge() does **not** persist it between checks.  A local dictionary doesn't work across multiple zope instances, so I'm using memcached to store the known expiration.\n\nAdditionally I found that the expiration is multiplied by 1000 from ZING (why??), so to compare this with the token we have to divide the value by 1000.  The previous change for ZING-821 did actually work, but only because the two values were *never* equal and it was parsing the accessToken with every request.. so that's been fixed also.","distinct":true,"url":"https://api.github.com/repos/zenoss/zenoss-prodbin/commits/b013fea68ec8edb0497d61ade187de6d03f724b8"}]}
{"actor":{"display_login":"rphillipsz"}}