upstream/wekan
2
0 Fork 1
mirror of https://github.com/wekan/wekan.git synced 2026-11-05 01:20:07 -05:00
Code Releases 1 Activity

Close #6681: OIDC redirect-style login loop, already fixed.

Browse Source 
The reporter's DEBUG=true server log (getToken/getUserInfo repeating six
times in under twenty seconds, a fresh access token each time) matches the
exact race commit 89682c251 already fixed: oauth2-login-style redirect with
oidc-redirection-enabled true re-firing the auto-redirect on the identity
provider's bounce-back render before the prior login had finished. That fix
landed before v11.62, several releases back; the reporter's build predates
it. tests/oidcAutoRedirectLoop.test.cjs (6 checks) still passes against
current source. No application code changed; asked the reporter to upgrade.

Thanks to Alishara and xet7 !

Fixes #6681,
This commit is contained in:
Lauri Ojansivu committed 2026-09-10 03:13:37 +03:00
1 parent ad0fa1c2f1
commit f3c39f3b2c
1 file changed
+31
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+31
View File
@@ -309,6 +309,37 @@ the Markdown commit as the template.
</details>
</details>
# Upcoming WeKan ® release
**In short:** issue #6681 (OIDC redirect-style login loop) is confirmed
already fixed and closed - the reporter's follow-up server log matches the
exact race already corrected by commit 89682c251, released starting v11.62.
No application code changed.
<details>
<summary>Confirm #6681 (OIDC redirect-style login loop) stays fixed</summary>
The reporter's `DEBUG=true` server log (getToken/getUserInfo repeating six
times in under twenty seconds, each with a fresh access token) is the same
signature the fix for #6681 already targets: `oauth2-login-style: redirect`
with `oidc-redirection-enabled: true`, `Template.userFormsLayout.onCreated`
re-firing the auto-redirect on the identity provider's bounce-back render
before the prior login had finished. That was fixed by commit 89682c251
("Fix OIDC auto-redirect looping until the provider rate-limits it"), which
landed before v11.62 - several releases before this one - so a build the
reporter's log shows as v11.60 predates the fix, and the fix has not been
touched since. `tests/oidcAutoRedirectLoop.test.cjs` (6 checks) still
passes against current source, confirming the one-shot sessionStorage flag
still gates the auto-redirect and is still cleared on both login success
and failure. No new code change was needed; the issue is closed with a
pointer to where it was already fixed, and the reporter is asked to upgrade
to v11.62 or newer.
</details>
Thanks to above GitHub users for their contributions and translators for their
translations.
# v11.66 2026-09-09 WeKan ® release
**In short:** the companion build repositories under `.tools/` move forward: