Allow to login into UI with token from api/v1/auth/login #2234

tdowgiel · 2020-09-28T07:24:56Z

Motivation and context

Allow to automatically log into CVAT-UI by 3rd part apps on the same cluster

How has this been tested?

In bash:

curl localhost:8080/api/v1/auth/login -X POST -H "Content-Type: application/json" -d '{"username": "some_name", "password": "some_password"}' -v # Get csrftoken & session id from the response

Make URL: http://localhost:8080/auth/login-with-token/:sessionid/:csrftoken
Paste it into a browser

Checklist

I submit my changes into the develop branch
I have added description of my changes into CHANGELOG file
I have updated the documentation accordingly
I have added tests to cover my changes
I have linked related issues (read github docs)
I have increased versions of npm packages if it is necessary (cvat-canvas,
cvat-core, cvat-data and cvat-ui)

License

I submit my code changes under the same MIT License that covers the project.
Feel free to contact the maintainers if that's a concern.
I have updated the license header for each file (see an example below)

# Copyright (C) 2020 Intel Corporation
#
# SPDX-License-Identifier: MIT

coveralls · 2020-09-28T08:16:13Z

Coverage remained the same at 65.32% when pulling 24ceb3d on tdowgiel:login-ui-with-token into 678f5b9 on openvinotoolkit:develop.

bsekachev · 2020-09-30T13:13:03Z

Hi, @tdowgiel
Is this PR ready? Can we review it?

tdowgiel · 2020-09-30T13:17:40Z

Thanks for asking, I’m in middle of testing it. Probably it won’t change a lot. I will give you sign when it will be fully tested.

bsekachev · 2020-10-01T06:53:41Z

@tdowgiel

Okay, nevertheless, let me comment some code-style issues and ideas about this PR.

cvat-ui/src/components/login-with-token/login-with-token.tsx

bsekachev · 2020-10-01T07:06:32Z

Also could you please increase minor version of cvat-ui (npm version minor in cvat/cvat-ui). You've checked this item in the PR description, but I don't see it is done

# Conflicts: # CHANGELOG.md # cvat-ui/src/components/cvat-app.tsx

cvat-ui/src/components/login-with-token/login-with-token.tsx

bsekachev · 2020-10-09T11:01:09Z

cvat-ui/src/components/login-with-token/login-with-token.tsx

+
+    if ( cookies['sessionid'] && cookies['csrftoken']) {
+        window.location.reload();
+        <Redirect to="/tasks" />


I suppose redirect after reload is useless. Moreover it should be wrapped into return ();
Maybe something like window.location = window.location.origin; would be more suitable

For some reason. I need to reload window to apply this changes. However, i have fixed issue with endless reloading when wrong token, by moving this to useEffect

bsekachev · 2020-10-09T11:05:09Z

Hi, @tdowgiel, I hope you are doing well.

I tried this PR and it doesn't seem to be a working solution.
Maybe I did something wrong, but in this case could you please provide steps to test it? (I just copied sessionid and token from active session, made URL, pasted it, and browser infinitely reloads the page).

Also POST request to http://localhost:8080/api/v1/auth/login with credentials returns json with key field, which is actually used to authorization via cvat-core and stored in the local storage, but I do not see it is used somehow in this patch.

…on with wrong tokens

tdowgiel · 2020-10-09T13:46:29Z

Hi, @tdowgiel, I hope you are doing well.

I tried this PR and it doesn't seem to be a working solution.
Maybe I did something wrong, but in this case could you please provide steps to test it? (I just copied sessionid and token from active session, made URL, pasted it, and browser infinitely reloads the page).

Also POST request to http://localhost:8080/api/v1/auth/login with credentials returns json with key field, which is actually used to authorization via cvat-core and stored in the local storage, but I do not see it is used somehow in this patch.

I have tested it in many ways. Response used in cvat-core is not only returning key but also setting cookie because of headers. Please look on example response and set-cookie header:

Date: Fri, 09 Oct 2020 13:35:16 GMT
Server: WSGIServer/0.2 CPython/3.8.3
Content-Type: application/json
Vary: Accept, Cookie, Origin
Allow: POST, OPTIONS
X-Frame-Options: DENY
Content-Length: 50
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
Set-Cookie: csrftoken=bAd9852nQZipwTvFnuELs29mdwowc3BGjuCsjpMfLrWT3txGVtaDp4jIboMBU1cq; expires=Fri, 08 Oct 2021 13:35:16 GMT; Max-Age=31449600; Path=/; SameSite=Lax sessionid=i8xqtviqysnfbi9n63rmhici3rb1nfo7; expires=Fri, 23 Oct 2020 13:35:16 GMT; HttpOnly; Max-Age=1209600; Path=/; SameSite=Lax

This is scenario:
I have access to the server with cvat. I want to integrate CVAT with my other webapp. And i want to share users between my app and cvat. Also core goal is to have user already logged in when he decide to use cvat.

Create django user on CLI
My backend send python request to cvat server to login django user
CVAT django server returns key, but also mentioned before 'Set Cookie' params.
User autologs in to CVAT thanks to /login-with-token/ parameters

bsekachev · 2020-10-09T14:14:12Z

cvat-ui/src/components/login-with-token/login-with-token.tsx

+import { Redirect, useParams } from 'react-router';
+import { useCookies } from 'react-cookie';
+
+export default function LoginWithTokenComponent(){


Please, add return type for the function JSX.Element

bsekachev · 2020-10-09T14:15:03Z

cvat-ui/src/components/cvat-app.tsx

@@ -10,6 +10,7 @@ import notification from 'antd/lib/notification';
 import Spin from 'antd/lib/spin';
 import Text from 'antd/lib/typography/Text';
 import GlobalErrorBoundary from 'components/global-error-boundary/global-error-boundary';
+import LoginWithTokenComponent from './login-with-token/login-with-token';


Please, use absolute import: components/login-with-token/login-with-token, or put the line after all absolute (linter says that relative import should occur after absolute)

# Conflicts: # CHANGELOG.md # cvat-ui/package-lock.json # cvat-ui/package.json

bsekachev · 2020-10-09T19:13:41Z

That's amazing, thanks for your patience and for the contribution!

tdowgiel added 2 commits September 28, 2020 09:17

Allow to login into UI with token from api/v1/auth/login

486e6d6

Update changelog

c0a129f

style

01db6f0

tdowgiel marked this pull request as ready for review September 28, 2020 09:49

tdowgiel requested review from bsekachev and nmanovic as code owners September 28, 2020 09:49

tdowgiel changed the title ~~Allow to login into UI with token from api/v1/auth/login~~ [WIP] Allow to login into UI with token from api/v1/auth/login Sep 28, 2020

nmanovic requested a review from vnishukov September 28, 2020 10:02

bsekachev reviewed Oct 1, 2020

View reviewed changes

cvat-ui/src/components/login-with-token/login-with-token.tsx Outdated Show resolved Hide resolved

cvat-ui/src/components/login-with-token/login-with-token.tsx Outdated Show resolved Hide resolved

cvat-ui/src/components/login-with-token/login-with-token.tsx Outdated Show resolved Hide resolved

tdowgiel added 3 commits October 8, 2020 08:05

Merge branch 'develop' into login-ui-with-token

86dde89

Merge branch 'develop' into login-ui-with-token

0a2bb4a

# Conflicts: # CHANGELOG.md # cvat-ui/src/components/cvat-app.tsx

Rev

602d409

tdowgiel changed the title ~~[WIP] Allow to login into UI with token from api/v1/auth/login~~ Allow to login into UI with token from api/v1/auth/login Oct 8, 2020

bsekachev reviewed Oct 9, 2020

View reviewed changes

bsekachev changed the title ~~Allow to login into UI with token from api/v1/auth/login~~ [WIP] Allow to login into UI with token from api/v1/auth/login Oct 9, 2020

Rev: Fixed style. Added cva-ui version to UI. Fixed endless redirecti…

5748e9b

…on with wrong tokens

tdowgiel changed the title ~~[WIP] Allow to login into UI with token from api/v1/auth/login~~ Allow to login into UI with token from api/v1/auth/login Oct 9, 2020

tdowgiel added 2 commits October 9, 2020 16:08

eslint

161f3e3

revert cvat-core/package-lock.json

6ddf120

bsekachev reviewed Oct 9, 2020

View reviewed changes

tdowgiel added 2 commits October 9, 2020 16:38

Rev: Fixed import order and return type

4b3e017

Merge branch 'develop' into login-ui-with-token

424c4b9

# Conflicts: # CHANGELOG.md # cvat-ui/package-lock.json # cvat-ui/package.json

tdowgiel requested a review from zhiltsov-max as a code owner October 9, 2020 14:51

Revert bindings

24ceb3d

bsekachev approved these changes Oct 9, 2020

View reviewed changes

bsekachev merged commit 2b221d2 into cvat-ai:develop Oct 9, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow to login into UI with token from api/v1/auth/login #2234

Allow to login into UI with token from api/v1/auth/login #2234

tdowgiel commented Sep 28, 2020 •

edited by bsekachev

coveralls commented Sep 28, 2020 •

edited

bsekachev commented Sep 30, 2020

tdowgiel commented Sep 30, 2020 via email •

edited

bsekachev commented Oct 1, 2020

bsekachev commented Oct 1, 2020

bsekachev Oct 9, 2020

tdowgiel Oct 9, 2020

bsekachev commented Oct 9, 2020

tdowgiel commented Oct 9, 2020

bsekachev Oct 9, 2020

bsekachev Oct 9, 2020

bsekachev commented Oct 9, 2020

Allow to login into UI with token from api/v1/auth/login #2234

Allow to login into UI with token from api/v1/auth/login #2234

Conversation

tdowgiel commented Sep 28, 2020 • edited by bsekachev

Motivation and context

How has this been tested?

Checklist

License

coveralls commented Sep 28, 2020 • edited

bsekachev commented Sep 30, 2020

tdowgiel commented Sep 30, 2020 via email • edited

bsekachev commented Oct 1, 2020

bsekachev commented Oct 1, 2020

bsekachev Oct 9, 2020

Choose a reason for hiding this comment

tdowgiel Oct 9, 2020

Choose a reason for hiding this comment

bsekachev commented Oct 9, 2020

tdowgiel commented Oct 9, 2020

bsekachev Oct 9, 2020

Choose a reason for hiding this comment

bsekachev Oct 9, 2020

Choose a reason for hiding this comment

bsekachev commented Oct 9, 2020

tdowgiel commented Sep 28, 2020 •

edited by bsekachev

coveralls commented Sep 28, 2020 •

edited

tdowgiel commented Sep 30, 2020 via email •

edited