feat(auth): Auto-redirect authenticated users on auth pages via BroadcastChannel#107390
feat(auth): Auto-redirect authenticated users on auth pages via BroadcastChannel#107390
Conversation
Add form submit event listener (capture phase) to sync CSRF token from cookie to form field right before submission. Also add manual sync in WebAuthnAssert since form.submit() doesn't fire the 'submit' event.
github-actions
Bot
added
Scope: Frontend
|
🚨 Warning: This pull request contains Frontend and Backend changes! It's discouraged to make changes to Sentry's Frontend and Backend in a single pull request. The Frontend and Backend are not atomically deployed. If the changes are interdependent of each other, they must be separated into two pull requests and be made forward or backwards compatible, such that the Backend or Frontend can be safely deployed independently. Have questions? Please ask in the |
Fix cookie parsing to use substring instead of split('=')[1] which
truncates values containing '=' characters (e.g., base64 padding).
This matches the defensive approach used in auth.html.
…castChannel When users have multiple tabs open on auth pages and log in on one tab, other tabs still show the login form. This adds BroadcastChannel-based cross-tab communication to auto-redirect authenticated users. Changes: - Add `organizations:auth-broadcast-channel-redirect` feature flag - On login success (SPA flow), broadcast a 'login' message to other tabs - Auth pages listen for 'login' messages and reload (server redirects auth'd users) - Add visibility change fallback for SSO flows where BroadcastChannel may miss This complements the CSRF token sync fix for multi-tab scenarios.
JoshFerge
force-pushed
the
jferg/auth-broadcast-channel-redirect
branch
from
aa0caf4 to
af6f72d
Compare
JoshFerge
changed the base branch from
master
to
jferg/csrf-token-submit-intercept
JoshFerge
force-pushed
the
jferg/csrf-token-submit-intercept
branch
from
7603c19 to
311eee4
Compare
|
This issue has gone three weeks without activity. In another week, I will close it. But! If you comment or otherwise update it, I will reset the clock, and if you remove the label "A weed is but an unloved flower." ― Ella Wheeler Wilcox 🥀 |
1 participant
Summary
When users have multiple tabs open on auth pages and log in on one tab, other tabs still show the login form. This PR adds BroadcastChannel-based cross-tab communication to auto-redirect authenticated users.
organizations:auth-broadcast-channel-redirectfeature flag for gradual rolloutThis complements the CSRF token sync fix (#107389) for multi-tab scenarios.
Browser Support
BroadcastChannel is supported in Chrome 54+, Firefox 38+, Safari 15.4+, Edge 79+. Falls back gracefully (visibility change or CSRF sync) on older browsers.
Test Plan
/auth/login/{org}/Files Changed
src/sentry/features/temporary.py- Add feature flagsrc/sentry/web/frontend/auth_organization_login.py- Pass feature flag to template contextsrc/sentry/templates/sentry/organization-login.html- Expose config to JavaScriptsrc/sentry/templates/sentry/bases/auth.html- Add BroadcastChannel listener + visibility fallbackstatic/app/views/auth/loginForm.tsx- Broadcast login event on success