[SLING-10383] Do not check for redirect loops when a login fails due to an expired token

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: Auth Core 1.5.4
• Component/s: Authentication
• Assignee: Robert Munteanu
• Reporter: Robert Munteanu
• Created: 17/May/21 11:50
• Updated: 25/May/21 09:23
• Resolved: 18/May/21 14:57

Description

Authentication tokens issued by Oak ( https://jackrabbit.apache.org/oak/docs/security/authentication/tokenmanagement.html ) have an expiry time. The following scenario can happen:

• user is logged in to page at /content/foo.html
• authentication token expires
• user clicks to a link that takes them to the same page - /content/foo.html

Due to the Referer header check in SlingAuthenticator.isLoginLoop the request is considered as part of a loop and does not trigger a redirect to the login page.

We should skip the loop check for expired credentials instead and allow the redirect login to be created.

Issue Links

• relates to: OAK-9433 TokenAuthentication.authenticate: throw specific exception for expired credentials
• links to: Pull request #10