🐛 Fixes session cookies for /studies with latest aiohttp

services/web/server/requirements/_base.in

@@ -8,8 +8,7 @@
 -r ../../../../packages/service-library/requirements/_base.in
 
 # aiohttp + extensions
-## Issue in https://github.com/ITISFoundation/osparc-simcore/issues/2008
-aiohttp==3.6.3
+aiohttp
 aiohttp_jinja2
 aiohttp_session[secure]
 aiohttp_security

services/web/server/requirements/_base.txt

@@ -18,7 +18,7 @@ aiohttp-session[secure]==2.9.0
     # via -r requirements/_base.in
 aiohttp-swagger[performance]==1.0.15
     # via -r requirements/_base.in
-aiohttp==3.6.3
+aiohttp==3.7.4.post0
     # via
     #   -r requirements/../../../../packages/service-library/requirements/_base.in
     #   -r requirements/_base.in
@@ -67,19 +67,21 @@ attrs==20.3.0
     #   openapi-core
 billiard==3.6.4.0
     # via celery
-celery[redis]==5.0.5
+cached-property==1.5.2
+    # via kombu
+celery[redis]==5.1.0
     # via -r requirements/_base.in
 cffi==1.14.5
     # via cryptography
 change-case==0.5.2
     # via -r requirements/_base.in
-chardet==3.0.4
+chardet==4.0.0
     # via aiohttp
 click-didyoumean==0.0.3
     # via celery
 click-plugins==1.1.1
     # via celery
-click-repl==0.1.6
+click-repl==0.2.0
     # via celery
 click==7.1.2
     # via
@@ -101,7 +103,7 @@ dataclasses==0.8
     #   werkzeug
 dnspython==2.1.0
     # via email-validator
-email-validator==1.1.2
+email-validator==1.1.3
     # via pydantic
 et-xmlfile==1.1.0
     # via openpyxl
@@ -119,7 +121,7 @@ idna==2.10
     #   email-validator
     #   idna-ssl
     #   yarl
-importlib-metadata==4.0.1
+importlib-metadata==4.5.0
     # via
     #   jsonschema
     #   kombu
@@ -146,7 +148,7 @@ jsonschema==3.2.0
     #   -r requirements/../../../../packages/service-library/requirements/_base.in
     #   openapi-schema-validator
     #   openapi-spec-validator
-kombu==5.0.2
+kombu==5.1.0
     # via celery
 lazy-object-proxy==1.4.3
     # via
@@ -156,7 +158,7 @@ markupsafe==1.1.1
     # via
     #   aiohttp-swagger
     #   jinja2
-multidict==4.7.6
+multidict==5.1.0
     # via
     #   aiohttp
     #   yarl
@@ -168,19 +170,19 @@ openapi-spec-validator==0.3.1
     # via openapi-core
 openpyxl==3.0.7
     # via -r requirements/_base.in
-orjson==3.5.2
+orjson==3.5.3
     # via -r requirements/_base.in
 pamqp==2.3.0
     # via aiormq
 parfive==1.0.2
     # via -r requirements/_base.in
 passlib==1.7.4
     # via -r requirements/_base.in
-prometheus-client==0.10.1
+prometheus-client==0.11.0
     # via -r requirements/../../../../packages/service-library/requirements/_base.in
 prompt-toolkit==3.0.18
     # via click-repl
-psycopg2-binary==2.8.6
+psycopg2-binary==2.9.1
     # via
     #   -r requirements/../../../../packages/service-library/requirements/_base.in
     #   aiopg
@@ -204,7 +206,7 @@ pyrsistent==0.17.3
     # via jsonschema
 python-engineio==3.14.2
     # via python-socketio
-python-magic==0.4.22
+python-magic==0.4.24
     # via -r requirements/_base.in
 python-socketio==4.6.1
     # via -r requirements/_base.in
@@ -247,7 +249,7 @@ strict-rfc3339==0.7
     # via openapi-core
 tenacity==7.0.0
     # via -r requirements/../../../../packages/service-library/requirements/_base.in
-tqdm==4.60.0
+tqdm==4.61.1
     # via parfive
 trafaret==2.1.0
     # via -r requirements/../../../../packages/service-library/requirements/_base.in
@@ -267,11 +269,12 @@ vine==5.0.0
     # via
     #   amqp
     #   celery
+    #   kombu
 wcwidth==0.2.5
     # via prompt-toolkit
 werkzeug==2.0.1
     # via -r requirements/../../../../packages/service-library/requirements/_base.in
-yarl==1.5.1
+yarl==1.6.3
     # via
     #   -r requirements/../../../../packages/postgres-database/requirements/_base.in
     #   aio-pika

services/web/server/requirements/_test.txt

@@ -4,14 +4,14 @@
 #
 #    pip-compile --output-file=requirements/_test.txt requirements/_test.in
 #
-aiohttp==3.6.3
+aiohttp==3.7.4.post0
     # via
     #   -c requirements/_base.txt
     #   aioresponses
     #   pytest-aiohttp
 aioresponses==0.7.2
     # via -r requirements/_test.in
-alembic==1.6.2
+alembic==1.6.5
     # via -r requirements/_test.in
 amqp==5.0.6
     # via
@@ -37,20 +37,23 @@ billiard==3.6.4.0
     #   -c requirements/_base.txt
     #   celery
 cached-property==1.5.2
-    # via docker-compose
-celery[redis]==5.0.5
+    # via
+    #   -c requirements/_base.txt
+    #   docker-compose
+    #   kombu
+celery[redis]==5.1.0
     # via
     #   -c requirements/_base.txt
     #   pytest-celery
-certifi==2020.12.5
+certifi==2021.5.30
     # via requests
 cffi==1.14.5
     # via
     #   -c requirements/_base.txt
     #   bcrypt
     #   cryptography
     #   pynacl
-chardet==3.0.4
+chardet==4.0.0
     # via
     #   -c requirements/_base.txt
     #   aiohttp
@@ -63,7 +66,7 @@ click-plugins==1.1.1
     # via
     #   -c requirements/_base.txt
     #   celery
-click-repl==0.1.6
+click-repl==0.2.0
     # via
     #   -c requirements/_base.txt
     #   celery
@@ -77,13 +80,13 @@ click==7.1.2
     #   click-repl
 codecov==2.1.11
     # via -r requirements/_test.in
-coverage[toml]==5.5
+coverage==5.5
     # via
     #   -r requirements/_test.in
     #   codecov
     #   coveralls
     #   pytest-cov
-coveralls==3.0.1
+coveralls==3.1.0
     # via -r requirements/_test.in
 cryptography==3.4.7
     # via
@@ -106,7 +109,7 @@ docopt==0.6.2
     # via
     #   coveralls
     #   docker-compose
-faker==8.2.0
+faker==8.8.1
     # via -r requirements/_test.in
 icdiff==1.9.1
     # via pytest-icdiff
@@ -120,7 +123,7 @@ idna==2.10
     #   idna-ssl
     #   requests
     #   yarl
-importlib-metadata==4.0.1
+importlib-metadata==4.5.0
     # via
     #   -c requirements/_base.txt
     #   jsonschema
@@ -142,7 +145,7 @@ jsonschema==3.2.0
     #   docker-compose
     #   openapi-schema-validator
     #   openapi-spec-validator
-kombu==5.0.2
+kombu==5.1.0
     # via
     #   -c requirements/_base.txt
     #   celery
@@ -158,7 +161,7 @@ markupsafe==1.1.1
     #   mako
 mccabe==0.6.1
     # via pylint
-multidict==4.7.6
+multidict==5.1.0
     # via
     #   -c requirements/_base.txt
     #   aiohttp
@@ -185,7 +188,7 @@ prompt-toolkit==3.0.18
     # via
     #   -c requirements/_base.txt
     #   click-repl
-psycopg2-binary==2.8.6
+psycopg2-binary==2.9.1
     # via
     #   -c requirements/_base.txt
     #   sqlalchemy
@@ -211,9 +214,9 @@ pytest-aiohttp==0.3.0
     # via -r requirements/_test.in
 pytest-celery==0.0.0
     # via -r requirements/_test.in
-pytest-cov==2.12.0
+pytest-cov==2.12.1
     # via -r requirements/_test.in
-pytest-docker==0.10.1
+pytest-docker==0.10.3
     # via -r requirements/_test.in
 pytest-icdiff==0.5
     # via -r requirements/_test.in
@@ -297,9 +300,9 @@ texttable==1.6.3
     # via docker-compose
 toml==0.10.2
     # via
-    #   coverage
     #   pylint
     #   pytest
+    #   pytest-cov
 typed-ast==1.4.3
     # via astroid
 typing-extensions==3.10.0.0
@@ -308,7 +311,7 @@ typing-extensions==3.10.0.0
     #   aiohttp
     #   importlib-metadata
     #   yarl
-urllib3==1.26.4
+urllib3==1.26.5
     # via
     #   -c requirements/../../../../requirements/constraints.txt
     #   requests
@@ -317,6 +320,7 @@ vine==5.0.0
     #   -c requirements/_base.txt
     #   amqp
     #   celery
+    #   kombu
 wcwidth==0.2.5
     # via
     #   -c requirements/_base.txt
@@ -325,11 +329,11 @@ websocket-client==0.59.0
     # via
     #   docker
     #   docker-compose
-websockets==9.0.2
+websockets==9.1
     # via -r requirements/_test.in
 wrapt==1.12.1
     # via astroid
-yarl==1.5.1
+yarl==1.6.3
     # via
     #   -c requirements/_base.txt
     #   aiohttp

services/web/server/requirements/_tools.txt

@@ -10,7 +10,7 @@ appdirs==1.4.4
     #   virtualenv
 argh==0.26.2
     # via watchdog
-black==21.5b1
+black==21.6b0
     # via -r requirements/../../../../requirements/devenv.txt
 bump2version==1.0.1
     # via -r requirements/../../../../requirements/devenv.txt
@@ -26,20 +26,20 @@ dataclasses==0.8
     # via
     #   -c requirements/_base.txt
     #   black
-distlib==0.3.1
+distlib==0.3.2
     # via virtualenv
 filelock==3.0.12
     # via virtualenv
-identify==2.2.4
+identify==2.2.10
     # via pre-commit
-importlib-metadata==4.0.1
+importlib-metadata==4.5.0
     # via
     #   -c requirements/_base.txt
     #   -c requirements/_test.txt
     #   pep517
     #   pre-commit
     #   virtualenv
-importlib-resources==5.1.3
+importlib-resources==5.1.4
     # via
     #   pre-commit
     #   virtualenv
@@ -57,7 +57,7 @@ pep517==0.10.0
     # via pip-tools
 pip-tools==6.1.0
     # via -r requirements/../../../../requirements/devenv.txt
-pre-commit==2.12.1
+pre-commit==2.13.0
     # via -r requirements/../../../../requirements/devenv.txt
 pyyaml==5.4.1
     # via
@@ -89,7 +89,7 @@ typing-extensions==3.10.0.0
     #   -c requirements/_test.txt
     #   black
     #   importlib-metadata
-virtualenv==20.4.6
+virtualenv==20.4.7
     # via pre-commit
 watchdog[watchmedo]==2.1.2
     # via -r requirements/_tools.in

services/web/server/src/simcore_service_webserver/studies_access.py

@@ -16,6 +16,7 @@
 from typing import Dict
 
 from aiohttp import web
+from aiohttp_session import get_session
 from aioredlock import Aioredlock
 from servicelib.application_keys import APP_CONFIG_KEY
 from servicelib.application_setup import ModuleCategory, app_module_setup
@@ -271,9 +272,14 @@ async def get_redirection_to_study_page(request: web.Request) -> web.Response:
     if is_anonymous_user:
         log.debug("Auto login for anonymous user %s", user["name"])
         identity = user["email"]
+
         await remember(request, response, identity)
+        assert (await get_session(request))["AIOHTTP_SECURITY"] == identity
+        # NOTE: session is encrypted and stored in a cookie in the session middleware
 
-    raise response
+    # WARNING: do NOT raise this response. From aiohttp 3.7.X, response is rebuild and cookie ignore.
+    # TODO: PC: security with SessionIdentityPolicy, session with EncryptedCookieStorage -> remember() and raise response.
+    return response
 
 
 @app_module_setup(__name__, ModuleCategory.ADDON, logger=log)