fix: Refresh the SAML request URL for each login attempt #10593
Conversation
The request contains the issue instant date, which needs to be fresh for CloudFlare Access.
| @@ -131,9 +130,10 @@ const EmailPasswordAuthForm = forwardRef((props: Props, ref: any) => { | |||
| const domain = getSSODomainFromEmail(email) | |||
| if (domain && domain !== pendingDomain) { | |||
| setPendingDomain(domain) | |||
| // Fetch the url to verify SSO is configured for this domain. | |||
| // Don't cache it as we need a fresh one for login | |||
There was a problem hiding this comment.
Given that the URL is generated on the fly by the server now, I'm curious, since this URL is generated but never used, why can't we use it for login? when does it go invalid?
There was a problem hiding this comment.
It really depends on the IDP. For CloudFlare it's about a minute. So if they idle a bit between entering their email and pushing the button, it's outdated. We really just fetch it here to check whether or not SAML is enabled for that domain.
There was a problem hiding this comment.
a minute, whoa!
we don't send off that request until the email field is blurred, so we can probably get away with caching it, but if the delay isn't too bad it shouldn't matter either way
There was a problem hiding this comment.
The issue is we cannot really check if it will be rejected because it happens after the redirect, so I would like to stay on the safe side.
The request contains the issue instant date, which needs to be fresh for CloudFlare Access.
Description
Fixes/Partially Fixes #[issue number]
[Please include a summary of the changes and the related issue]
Demo
[If possible, please include a screenshot or gif/video, it'll make it easier for reviewers to understand the scope of the changes and how the change is supposed to work. If you're introducing something new or changing the existing patterns, please share a Loom and explain what decisions you've made and under what circumstances]
Testing scenarios
[Please list all the testing scenarios a reviewer has to check before approving the PR]
Scenario A
Scenario B
Final checklist