High Issue Summary
session.tokenkey value sometimes generated with quotes. This can impact the SSO experience by unexpectedly overwriting cookies
Environment
- Crowd 3.3.3
- Confluence any version
Steps to Reproduce
- Connect Confluence and Crowd with SSO
- Login to Confluence as Crowd users
- Go to Browser Console, to check the session cookies generated
Expected Results
Session.tokenkey (or crowd.token_key) value will not have quotes
Actual Results
Session.tokenkey (or crowd.token_key) values will have quotes when an equal(=) sign exist in the token
Looking into the HAR file, the token with quotes will have 1 pair of quotes being escaped that look something like this:
"name": "crowd.token_key", "value": "\"xxxxxxxxxxxxxxxxx=\"",
Notes
- This issue not seen without SSO
- This issue does not exists in Crowd version 3.2.5
Workaround
- As the Token is being generated randomly, the affected user can try to Log Out and re-Log In again to get a new token generated.
There are still chances that after re-logging the user still get another token with an equal(=) symbol in it and hitting into the same issue
- mentioned in
-
Page Failed to load
[CWD-5352] session.tokenkey value randomly generated with quotes causing login issues to applications
| Epic Link | Original: CWD-4704 [ 600140 ] |
| Workflow | Original: Simplified Crowd Development Workflow v2 - restricted [ 3092712 ] | New: JAC Bug Workflow v3 [ 3365579 ] |
| Status | Original: Resolved [ 5 ] | New: Closed [ 6 ] |
using Crowd 3.1.2 over HTTPS, but I don't see above given token pattern in cookies. DO you know why is that? 
| UIS | Original: 241 | New: 262 |
Confirming that 3.4.5 has resolved this issue for us - thanks for the fix team Crowd!
| Resolution | New: Fixed [ 1 ] | |
| Status | Original: In Progress [ 3 ] | New: Resolved [ 5 ] |
| Support reference count | Original: 12 | New: 13 |
| Description |
Original:
h3. Issue Summary
session.tokenkey value sometimes generated with quotes h3. Environment * Crowd 3.3.3 * Confluence any version h3. Steps to Reproduce # Connect Confluence and Crowd with SSO # Login to Confluence as Crowd users # Go to Browser Console, to check the session cookies generated h3. Expected Results Session.tokenkey (or crowd.token_key) value will not have quotes h3. Actual Results Session.tokenkey (or crowd.token_key) values will have quotes when an _equal_(=) sign exist in the token !tokenkey.png|thumbnail! (i) Looking into the HAR file, the token with quotes will have 1 pair of quotes being _escaped_ that look something like this: {code:java} "name": "crowd.token_key", "value": "\"xxxxxxxxxxxxxxxxx=\"", {code} h3. Notes * This issue not seen without SSO * This issue does not exists in Crowd version 3.2.5 h3. Workaround * As the Token is being generated randomly, the affected user can try to *Log Out* and *re-Log In* again to get a new token generated. * (!) There are still chances that after re-logging the user still get another token with an _equal_(=) symbol in it and hitting into the same issue |
New:
h3. Issue Summary
session.tokenkey value sometimes generated with quotes. This can impact the SSO experience by unexpectedly overwriting cookies h3. Environment * Crowd 3.3.3 * Confluence any version h3. Steps to Reproduce # Connect Confluence and Crowd with SSO # Login to Confluence as Crowd users # Go to Browser Console, to check the session cookies generated h3. Expected Results Session.tokenkey (or crowd.token_key) value will not have quotes h3. Actual Results Session.tokenkey (or crowd.token_key) values will have quotes when an _equal_(=) sign exist in the token !tokenkey.png|thumbnail! (i) Looking into the HAR file, the token with quotes will have 1 pair of quotes being _escaped_ that look something like this: {code:java} "name": "crowd.token_key", "value": "\"xxxxxxxxxxxxxxxxx=\"", {code} h3. Notes * This issue not seen without SSO * This issue does not exists in Crowd version 3.2.5 h3. Workaround * As the Token is being generated randomly, the affected user can try to *Log Out* and *re-Log In* again to get a new token generated. * (!) There are still chances that after re-logging the user still get another token with an _equal_(=) symbol in it and hitting into the same issue |
| UIS | Original: 201 | New: 241 |
Hershan, It seemed to depend on the length of the username . Our test show 21-chars don't generate an '=', but 20-chars long does, 19-chars does.
I think from memory it went something like NO, NO, YES for 19,20,21 as a username length and repeats that pattern.