Can't login from the project link

[huumq00731]

1. Open browser(not logged in) and go to project link.

for example: http://IP:9740/projects/6

2. Log in with correct password

3. Incorrect pass msg will be show.

Your Environment

Doccano lastest code of master branch.

[icoxfog417]

Can you login from the front page (http://IP:PORT) but can not log in from the project link?

[kuraga]

I have strange issues like this but not permanently... But seems like it sometimes appears if I signed in in Django Admin first...

[huumq00731]

Can you login from the front page (http://IP:PORT) but can not log in from the project link?

Yes. I can login from the front page.
But when i share project link for another members. They can't login

[huumq00731]

I have been updated version of doccano to [lastest code of master branch].
not 1.0.2

[Hironsan]

Problem and analysis

This is due to the authentication priority.

In Django Rest Framework, we can specify the authentication classes in DEFAULT_AUTHENTICATION_CLASSES. The more previous, the higher the priority. In doccano, SessionAuthentication is prior to TokenAuthentication.

doccano/app/app/settings.py

Lines 218 to 221 in 8818ab1

	'DEFAULT_AUTHENTICATION_CLASSES': (
	'rest_framework.authentication.SessionAuthentication',
	'rest_framework.authentication.TokenAuthentication',
	),

When we sign in to the admin page, we use SessionAuthentication as an authentication method, but when we sign in from the front page, we use TokenAuthentication. So if we sign in to the admin page before signing in from the front page, session id and csrftoken are stored in Cookies.

If we sign in from the front page after we already have signed to the admin page, session id and csrftoken are sent to the server because they are stored in the cookies.

As a result, the server tries to accept the request as a session authentication. But after v1.0.0, we can sign in to the application only using token authentication. That's why the strange behavior is observed.

Quick-fix solution

Comment out SessionAuthentication in DEFAULT_AUTHENTICATION_CLASSES. It does not prevent you from signing in to the admin page because the SessionAuthentication is different from Django admin's session authentication.