Server mode OAuth2: 'NoneType' object is not subscriptable on every request after re-submitting the OAuth2 login while already logged in

已关闭 适合新手
  • 哪里不对？
#10,733 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 4 天内回复

还没有人认领这个 Issue。

  • #10734 来自 @Rarasinhoo —— 已关闭，未合并

评估

难度
1/5
预计耗时
1 小时以内
新手友好度
88/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
python
领域
authentication

调研方向

从 pgadmin/__init__.py 中约第 1010 行的 before_request，以及 issue 中描述的 authenticate.login() 流程开始。追踪 OAuth2 重定向将 auth_source_manager 设为 None 后，它是如何被检查的。issue 报告了一项只涉及一个条件的修复；确认受影响的请求不再引发 TypeError。

由索引模型根据 Issue 内容生成。

描述

Describe the bug

In server mode with OAuth2, a browser that is already logged in and submits the OAuth2 login button again ends up with session['auth_source_manager'] = None while current_user.is_authenticated is still true. From then on before_request raises TypeError: 'NoneType' object is not subscriptable on every request, including /logout and /login, so the user cannot recover from the UI. Only clearing the cookies, waiting for the session to expire, or restarting the server unblocks them.

This looks like the same error as #9476, which was closed because it could not be reproduced. The steps below reproduce it every time.

To Reproduce

Official image dpage/pgadmin4:9.19.0. The code is the same on master. Use this config_local.py; the OAuth2 provider does not need to exist:

AUTHENTICATION_SOURCES = ['internal', 'oauth2']
OAUTH2_CONFIG = [{
    'OAUTH2_NAME': 'fake', 'OAUTH2_DISPLAY_NAME': 'Fake',
    'OAUTH2_CLIENT_ID': 'x', 'OAUTH2_CLIENT_SECRET': 'y',
    'OAUTH2_TOKEN_URL': 'https://idp.invalid/token',
    'OAUTH2_AUTHORIZATION_URL': 'https://idp.invalid/authorize',
    'OAUTH2_API_BASE_URL': 'https://idp.invalid/', 'OAUTH2_USERINFO_ENDPOINT': 'me',
    'OAUTH2_SCOPE': 'openid email',
}]
  1. Log in with the internal user. GET /browser/ returns 200.
  2. While still logged in, open /login. The login page is rendered for an authenticated user. Submit the OAuth2 button (POST /authenticate/login with oauth2_button=fake). It returns a 302 to the provider.
  3. Do not complete the provider login, or come back from it. GET /browser/, /favicon.ico, /logout and /login all return 500.

In production with Microsoft Entra, the same thing happens on the /oauth2/authorize callback. It typically hits a user who still has a valid session and clicks "Login with Microsoft" from an old tab or a bookmarked /login?next=/.

Expected behavior

An authenticated session that has auth_source_manager set to None (set in authenticate.login() before the OAuth2 redirect) should not crash before_request.

Error message

ERROR pgadmin: 'NoneType' object is not subscriptable
  File "/pgadmin4/pgadmin/__init__.py", line 1010, in before_request
    session['auth_source_manager']['current_source'] not in \
TypeError: 'NoneType' object is not subscriptable

Cause and fix

authenticate.login() runs session['auth_source_manager'] = None, but before_request only checks that the key is present ('auth_source_manager' in session) before subscripting it. If that check becomes session.get('auth_source_manager'), steps 1–3 return 200/302 and the traceback no longer appears. I verified this by mounting the patched file in the 9.19.0 image. A PR follows.

Desktop

  • Server mode (Docker, dpage/pgadmin4:9.19.0), OAuth2 with Microsoft Entra ID
  • Browser: Chrome 157 / curl
主要语言
Python
星标
3.9k
派生
914
平均合并
2 天 10 小时
30 天内合并 PR
25

环境准备

  • 提供 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

pgadmin-org/pgadmin4 的其他 Issue

查看 pgadmin-org/pgadmin4 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。