[NIFI-6085] Bearer Token isn't killed after user logs out

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.5.0
• Fix Version/s: 1.10.0
• Component/s: Security
• Assignee: Nathan Gough
• Reporter: Abdu Sahin
• Created: 27/Feb/19 13:10
• Updated: 09/May/19 00:49
• Resolved: 09/May/19 00:49

Description

I observed that Authorization Bearer token is not invalidated after a logout.

Steps to produce 

Step 1: Login to Nifi as usual.

Step 2: Copy the authorisation bearer token after the login from /nifi-api/access/token response.

Step 3: Make a request a curl request as below and observe http 200 response is received with status information.

curl -v -H "Authorization: Bearer <Token>" https://nifi-server/nifi-api/flow/status

Step 4: Log out from Nifi Console 

Step 5: Repeat Step 3 and observe again http 200 response is received with status information even though the user has logged out.

 

Issue Links

• relates to: NIFI-6280 Re-evaluate handling of Authorization bearer token during JWT logout
• links to: GitHub Pull Request #3362