Why does SplunkWeb controller intermittently throw exception "AuthenticationFailed"?

LukeMurphey — Thu, 19 Feb 2015 19:34:34 GMT

I have a SplunkWeb controller that intermittently throws the following exception:

AuthenticationFailed: [HTTP 401] Client is not authenticated

Its odd because the controller works about 80% of the time.

Re: Why does SplunkWeb controller intermittently throw exception "AuthenticationFailed"?

LukeMurphey — Thu, 19 Feb 2015 19:40:30 GMT

If the controller caches the session then it is possible that it will keep the key around longer than its lifetime. This is because controllers stay running in SplunkWeb and thus a key can easily be kept around longer than its lifetime.

You should always get a new key by calling cherrypy.session.get('sessionKey'). Don't store the key or keep it around.

For example, I have seen this happen when someone cached the key in the constructor:

class SomeController(controllers.BaseController):

    def __init__(self):
        self.sessionKey = cherrypy.session.get('sessionKey')
        super(SomeController, self).__init__()

    @expose_page(must_login=True, methods=['POST']) 
    def update(self, **kwargs):
        doUpdate(self.sessionKey) # Using cached key. Oh no!

Instead, the session should be obtained just before use:

class SomeController(controllers.BaseController):

    def __init__(self):
        super(SomeController, self).__init__()

    @expose_page(must_login=True, methods=['POST']) 
    def update(self, **kwargs):
        doUpdate(cherrypy.session.get('sessionKey')) # Using a fresh key!

topic Why does SplunkWeb controller intermittently throw exception "AuthenticationFailed"? in Security

Why does SplunkWeb controller intermittently throw exception "AuthenticationFailed"?

Re: Why does SplunkWeb controller intermittently throw exception "AuthenticationFailed"?