ANUSF/ADA-CMS — Issue #2: Spurious error messages due to session verification
Author: odf
Created: 2011-11-24 04:10:57+00:00
State: open
Labels: Bug, Urgent

Since upgrading Adapt to Rails 3.1, I've started to see errors produced by the OpenID client code while verifying the validity of the current user session. This could in principle affect the CMS, as well, but I haven't seen any evidence so far.

In a nutshell, the client code normally checks for a time stamp cookie produced by the OpenID server, but in order to prevent problems due to deleted or stale cookies, forces re-authentication with the server after a certain time interval. In order to make this process transparent for the user, all session and request data is stored in another cookie and restored after successful authentication. It seems that Rails 3.1 is now imposing a rather strict limit on the size of cookies, and metadata updates in Adapt typically exceed that limit, which is why we are seeing this error.

There are several potential workarounds such as using multiple cookies or a different mechanism to preserver the data during the authentication procedure. But this is getting increasingly messy, so I think we would fare better by having a more direct way - i.e. without redirecting the browser - for clients to communicate with the server and find out if a specific session is still valid.

While I investigate this, I propose to turn the forced re-authentication off for Adapt and tell archivists to be extra careful and always log out directly from within in case they happen to use it on a shared browser.