Why does SplunkWeb controller intermittently throw exception "AuthenticationFailed"?

[LukeMurphey]

I have a SplunkWeb controller that intermittently throws the following exception:

AuthenticationFailed: [HTTP 401] Client is not authenticated

Its odd because the controller works about 80% of the time.

[LukeMurphey · Accepted solution]

If the controller caches the session then it is possible that it will keep the key around longer than its lifetime. This is because controllers stay running in SplunkWeb and thus a key can easily be kept around longer than its lifetime.

You should always get a new key by calling cherrypy.session.get('sessionKey'). Don't store the key or keep it around.

For example, I have seen this happen when someone cached the key in the constructor:

class SomeController(controllers.BaseController):

    def __init__(self):
        self.sessionKey = cherrypy.session.get('sessionKey')
        super(SomeController, self).__init__()

    @expose_page(must_login=True, methods=['POST']) 
    def update(self, **kwargs):
        doUpdate(self.sessionKey) # Using cached key. Oh no!

Instead, the session should be obtained just before use:

class SomeController(controllers.BaseController):

    def __init__(self):
        super(SomeController, self).__init__()

    @expose_page(must_login=True, methods=['POST']) 
    def update(self, **kwargs):
        doUpdate(cherrypy.session.get('sessionKey')) # Using a fresh key!