tree 714caa1ced867c86e85026b447f0670c4bee8b71
parent 86f4056a2dfee6fced5b5b03de04a7ef9c33d74f
author Wiktor Gołgowski <wiktor.golgowski@intel.com> 1575978405 +0100
committer Wiktor Gołgowski <wiktor.golgowski@intel.com> 1576500309 +0100

User logged in when IsAuthenticated cookie is set.

Related to https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/27270

Currently the only condition checked when user is logged in was the
"LOGIN_ID" value in browser session storage. The only place in the code
where it is set is the Basic Authorization flow.

In case of mTLS authentication, we are not able to set session storage
value. This is why additional 'IsAuthenticated' cookie is added.

In the case when user session expires, the failing XHR should cause the
page to redirect to the login prompt. Additionally, IsAuthenticated
cookie is removed to disable redirection.

Tested: verified the flow with the mTLS changes. User is put in the
webUI interface without login prompt when using mTLS authentication. If
the authentication fails, browser redirects to the login page.

Signed-off-by: Wiktor Gołgowski <wiktor.golgowski@intel.com>
Change-Id: Ia7061f3e146c6547d4bfdf42940150b1a5c06903