Security

Why does SplunkWeb controller intermittently throw exception "AuthenticationFailed"?

Champion

I have a SplunkWeb controller that intermittently throws the following exception:

AuthenticationFailed: [HTTP 401] Client is not authenticated

Its odd because the controller works about 80% of the time.

0 Karma
1 Solution

Champion

If the controller caches the session then it is possible that it will keep the key around longer than its lifetime. This is because controllers stay running in SplunkWeb and thus a key can easily be kept around longer than its lifetime.

You should always get a new key by calling cherrypy.session.get('sessionKey'). Don't store the key or keep it around.

For example, I have seen this happen when someone cached the key in the constructor:

class SomeController(controllers.BaseController):

    def __init__(self):
        self.sessionKey = cherrypy.session.get('sessionKey')
        super(SomeController, self).__init__()

    @expose_page(must_login=True, methods=['POST']) 
    def update(self, **kwargs):
        doUpdate(self.sessionKey) # Using cached key. Oh no!

Instead, the session should be obtained just before use:

class SomeController(controllers.BaseController):

    def __init__(self):
        super(SomeController, self).__init__()

    @expose_page(must_login=True, methods=['POST']) 
    def update(self, **kwargs):
        doUpdate(cherrypy.session.get('sessionKey')) # Using a fresh key!

View solution in original post

0 Karma

Champion

If the controller caches the session then it is possible that it will keep the key around longer than its lifetime. This is because controllers stay running in SplunkWeb and thus a key can easily be kept around longer than its lifetime.

You should always get a new key by calling cherrypy.session.get('sessionKey'). Don't store the key or keep it around.

For example, I have seen this happen when someone cached the key in the constructor:

class SomeController(controllers.BaseController):

    def __init__(self):
        self.sessionKey = cherrypy.session.get('sessionKey')
        super(SomeController, self).__init__()

    @expose_page(must_login=True, methods=['POST']) 
    def update(self, **kwargs):
        doUpdate(self.sessionKey) # Using cached key. Oh no!

Instead, the session should be obtained just before use:

class SomeController(controllers.BaseController):

    def __init__(self):
        super(SomeController, self).__init__()

    @expose_page(must_login=True, methods=['POST']) 
    def update(self, **kwargs):
        doUpdate(cherrypy.session.get('sessionKey')) # Using a fresh key!

View solution in original post

0 Karma