Login successful but user not authenticated about bitcoin-spring-boot-starter HOT 8 CLOSED

Not so fast @straumat! : -)

Maybe it is not the correct approach to throw AuthenticationException or AuthenticationServiceException.
It might be that SessionAuthenticationException is better or not throwing an exception at all!
I will read into it and close the ticket only when a suitable solution has been found!

Thank you @straumat 🙏
You really help me a lot with your insights!

from bitcoin-spring-boot-starter.

Ok! it now works!

from bitcoin-spring-boot-starter.

Hey @straumat!

I was wondering why the browser does not poll with the same k1 value as seen in your logs..

The problem is in your exception handling:

// If the user is not authenticated when accessing a protected page, redirect to the login page.
.exceptionHandling((exceptionHandling) -> exceptionHandling
        .accessDeniedPage(ERROR_403_PAGE)
        .authenticationEntryPoint((request, response, authenticationException) -> response.sendRedirect(LNURL_AUTH_LOGIN_PAGE_PATH))
)

When a user polls the session migration endpoint, it will throw an exception if the user has not been paired with a linking key.
In your setup, this will "redirect" the user to the login page again, creating a new k1, repeating this over and over again.

I do not know if the session migration endpoint breaks any spring-security contracts by throwing an exception.. maybe it should just return an error by returning a proper http status? What do you think?

from bitcoin-spring-boot-starter.

Hi :) Ok, I had a bug in findPairedLinkingKeyByK1, it works now, I can log in :) Thx !
I will move to the new pairK1WithLinkingKey and write the blog post.
You can close this issue and thx again

from bitcoin-spring-boot-starter.

For information, with the develop release, this doesn't work anymore:

// If the user is not authenticated when accessing a protected page, redirect to the login page.
.exceptionHandling((exceptionHandling) -> exceptionHandling
        .accessDeniedPage(ERROR_403_PAGE)
        .authenticationEntryPoint((request, response, authenticationException) -> response.sendRedirect(LNURL_AUTH_LOGIN_PAGE_PATH))
)

from bitcoin-spring-boot-starter.

For information, with the develop release, this doesn't work anymore:

// If the user is not authenticated when accessing a protected page, redirect to the login page.
.exceptionHandling((exceptionHandling) -> exceptionHandling
        .accessDeniedPage(ERROR_403_PAGE)
        .authenticationEntryPoint((request, response, authenticationException) -> response.sendRedirect(LNURL_AUTH_LOGIN_PAGE_PATH))
)

What do you mean, it does not work anymore?

from bitcoin-spring-boot-starter.

with 0.12, I could login with that code.
with develop, i have to comment to login

from bitcoin-spring-boot-starter.

with 0.12, I could login with that code. with develop, i have to comment to login

Hmm.. I do not think so.. it should have never worked -> #116 (comment)

from bitcoin-spring-boot-starter.