Uploaded image for project: 'Nuxeo Platform'
  1. Nuxeo Platform
  2. NXP-26843

Fix security not restricted enough when logging anew with a restricted user

    XMLWordPrintable

    Details

    • Release Notes Summary:
      The BasicAuth challenge is not displayed when a request comes with the Cookie header.
    • Tags:
    • Backlog priority:
      800
    • Browser:
    • Sprint:
      nxsupport 11.1.7

      Description

      In WebUI, if session times out, you are prompted to log again using basic authentication pop-up.
      When logging as another user than the previous one, the display enables the new user to see many features enabled to the previous user, e.g. Administrator.

      Requesting to display only features enabled to the new user after relogging.

        Attachments

          Issue Links

          is duplicated by

          Bug - A problem which impairs or prevents the functions of the product. NXP-24792 Don't challenge clients with basic auth on api calls with invalid credentials

          • Critical - Crashes, loss of data, severe memory leak.
          • Resolved
          is related to

          Bug - A problem which impairs or prevents the functions of the product. NXP-19322 Do not disable prompt handling by default on automation authentication chain

          • Blocker - Blocks development and/or testing work, production could not run.
          • Resolved

          Bug - A problem which impairs or prevents the functions of the product. NXP-25021 Handle expired session in WebUI

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Resolved

          Bug - A problem which impairs or prevents the functions of the product. NXP-26208 Handle expired session in WebUI properly

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Resolved
          Is referenced in

          [Captain Hook] PR for 10.10: #4176 PR for 10.10: #4176

          [Captain Hook] PR for master: #4181 PR for master: #4181

          [Captain Hook] PR for master: #4294 PR for master: #4294

          [Captain Hook] PR for master: #4597 PR for master: #4597

            Activity

              People

              • Votes:
                0 Vote for this issue
                Watchers:
                7 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 2 hours, 40 minutes
                  2h 40m