Optional User Session#406
Merged
Merged
Conversation
auto-merge was automatically disabled
May 15, 2026 11:23
Pull request was converted to draft
bjoernricks
force-pushed
the
optional-user-session
branch
2 times, most recently
from
a54e163 to
f68f0e6
Compare
This seems to be a leftover from ancient XSLT times.
Avoid crashing if the user is not available. This will be the case for the JWT only mode.
If we don't have a user from the session aka. JWT only mode don't add the client address, locale, session timeout, timezone or token to the envelope.
Don't require a token for getting the user out of the session and support JWT only mode for http get requests.
Setting the timezone is not necessary for gsad anymore. It seems like a leftover from ancient XSLT times.
Using the params struct allows to get the token for GET **and** POST requests and also validates the token.
Before the validation of the parameters was done later for POST requests (or even never). With this change it is ensured that all parameters are valid for every request getting in our handler chain.
…ests We don't care about the accept language header value at all therefore we can safely ignore it.
Don't crash if the user is not available. This will be required for the JWT mode.
Require user or jwt for all requests to the `/gmp` and `/system_report` endpoints. Otherwise return a 401 response.
Also only logout all user sessions only if a user is available. This avoids crashing in JWT mode.
Remove the user and credential setup from the exec_gmp_post method to reduce duplicated code. Both will be done in a next commit via the http handler chain instead. With this change exec_gmp_post and exec_gmp_get are very similar and only handle GMP specific business logic.
The cookie data is not used anymore.
Refactor setting up user and credentials for all API calls. With the changed exec_gmp_post function is is possible to use the same handler chain for all API calls.
Always send all GMP commands even if the user has no capability for the command. Just let gvmd handle it. We don't have capabilities of the user in JWT mode. Therefore it doesn't make sense to check it. Also the functions using command enabled are very special and GSA should not use their endpoints anymore.
Don't crash if the user is not available. This is the case in the JWT mode.
bjoernricks
force-pushed
the
optional-user-session
branch
from
f68f0e6 to
ad5d52e
Compare
ozgen
approved these changes
May 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Make the User Session optional.
Disclaimer: The session timeout doesn't work correctly with JWT at the moment.
Why
With this change there are two kinds of authentication:
The standard and default mode is the session based mode which uses a token and a cookie to create a session and to identify a user. This mode is stateful.
The new mode is JWT based and uses the Authorization header to get the JSON web token. The JWT is passed to GMP without creating a session within gsad. The session is bound to the lifetime of the JWT currently. This mode is stateless.
References
https://jira.greenbone.net/browse/GEA-1668