HTTP Basic Auth Fails if "logout_on_timeout true" about authlogic

[joescharf]

Yes I have had this problem too, HTTP auth will work in this situation if you create a session by logging in through the web application, but when the session times out due to logout_on_timeout, it prevents further HTTP auth. Haven't had time yet to diagnose the issue.

[skippy]

I ran into this issue with a single_access_token...

in lib/sessions/timeout.rb, you need to replace:

      before_persisting :reset_stale_state
      after_persisting :enforce_timeout

with

      before_persisting :reset_stale_state, :unless => :single_access?
      after_persisting :enforce_timeout,    :unless => :single_access?

I was going to open another issue for this... but I bet this will also fix this basic http auth issue

[stouset]

I ran into this as well with single access tokens. Going to try skippy's patch.

[joescharf]

I tried that patch and it didn't work - I though I had added that response to that thread, but apparently it isn't here. Let me know how it goes for you though...

[stouset]

The patch worked for me, for the most part. I extracted it into a separate file so that the file can be included and fix Authlogic in situ.

http://gist.github.com/271724

[skippy]

fantastic! Thanks Stouset for sharing that.

[jayuen]

I have the exact same issue as quantipay. I am trying to use HTTP basic authentication for a user that is logging in for the first time (i.e. last_request_at is nil) or logging in after a stale session (i.e. last_request_at > timeout interval).

After poking around the code, it seems that in lib/authlogic/session/persistence.rb, the persisting? method invokes the after_persisting callback method. Part of the callback chain is the enforce_timeout method in lib/authlogic/session/timeout.rb which nils out the record. This affects subsequent after_persisting callbacks (e.g. in magic_columns.rb and session.rb) and once control is back in the persisting? method, there is no record to save. This seems odd but I'm not sure what should be the proper way to workaround/resolve this. Any help would be appreciated.

Jason

[jayuen]

I also wanted to add that I was only experiencing this issue when Authlogic::CryptoProviders::BCrypt.cost was greater than or equal to 4. Found that really odd...

[pwim]

Unfortunately this bug is still around. I enhanced stouset's gist to fix the issue for HTTP basic: http://gist.github.com/520483

[ivalkeen]

It seems, there is a typo in pwim's patch. Here is fixed version: http://gist.github.com/582684

[pwim]

Indeed there was a bug, thanks for the patch of my patch.

[goldmaneye]

This patch works like a charm, but I'm curious as to why the fix hasn't been made in Authlogic itself yet.

[jaredbeck]

Closing after five years with no activity. If this is still a problem in the latest version (currently 3.5.0), please let us know and we'll be happy to re-open the issue.