Forum

November 2nd, 2014
A A A
Avatar

Lost password?
Advanced Search

— Forum Scope —




— Match —





— Forum Options —





Minimum search word length is 3 characters - maximum search word length is 84 characters

The forums are currently locked and only available for read only access
sp_Feed Topic RSS sp_Related Related Topics sp_TopicIcon
OpenID with JQGrid running afoul of...?
30/05/2012
23:50
Avatar
rickwayne
Member
Members
Forum Posts: 3
Member Since:
30/05/2012
sp_UserOfflineSmall Offline

I have a Ruby on Rails 3 application which makes heavy use of JQGrid (for which, thanks!).

I'm using ruby-openid to do authentication with Google, and used Seth Ladd's nice recipe to get that working.

Which it does -- for page views and POSTS from web forms.

However, whenever JQGrid does a POST to update data on the server, two things happen:

  1. Even if the user's browser is already authenticated via logging in to Google, the POST appears to the server as if it were coming from an unauthenticated one, and gets redirected to the OpenID authentication dance. That wouldn't be a showstopper except that
  2.  As soon as the server sends back the 401 that's supposed to initiate the redirect-and-authenticate thing, the whole enchilada just stops dead. Normally (as in, say, a POST request from a form submission with a standard web page), the browser sees the 401, reads the enclosed "authenticate over here" info, does the dance, comes back with the session set up, and the cycle continues. But from JQuery/JQGrid...not so much.

Any ideas? I'm confident that I'm missing something obvious here, but I've got one of Rumsfeld's "unknown unknowns" going, I don't know what it is that I'm missing, much less how to fix it! Seems like this should be a long-solved problem, eh?

I could be running afoul of XSS defenses, but if so I've no idea how to proceed other than ****-canning the serious investment we've already made in OpenID (including users already signing up & having to furnish/remember passwords -- ick!).

Thanks in advance!

(Rails 3.0.7, ruby-openid 2.1.8, JQGrid 3.5.3, JQuery 1.3.2, using Google as the OP so that user never has to type in their identity URL.)

31/05/2012
00:11
Avatar
rickwayne
Member
Members
Forum Posts: 3
Member Since:
30/05/2012
sp_UserOfflineSmall Offline

It looks as if the anti-XSS stuff is indeed the culprit. From the OpenID Code users group, I already got the response quoted below.

And when I turn off "protect_from_forgery" in Rails, it goes through fine. So my question now becomes "how do I supply the correct header from my JQGrid POSTs?"

Have you checked for the anti cross site request forgery header in the ajax request? 
Rails won't accept post requests without that by default.
Forum Timezone: Europe/Sofia

Most Users Ever Online: 715

Currently Online:
64 Guest(s)

Currently Browsing this Page:
1 Guest(s)

Top Posters:

OlegK: 1255

markw65: 179

kobruleht: 144

phicarre: 132

YamilBracho: 124

Renso: 118

Member Stats:

Guest Posters: 447

Members: 11373

Moderators: 2

Admins: 1

Forum Stats:

Groups: 1

Forums: 8

Topics: 10592

Posts: 31289

Newest Members:

, razia, Prankie, psky, praveen neelam, greg.valainis@pa-tech.com

Moderators: tony: 7721, Rumen[Trirand]: 81

Administrators: admin: 66

Comments are closed.
Privacy Policy   Terms and Conditions   Contact Information