0

We have two different OAuth2/OKTA-enabled JHipster monolith applications, one uses JHipster version 6.10.5, and the other version 7.9.2. These webapps use the OKTA sign-in widget and are represented as different applications in OKTA, each with its own client-id/secret. Each webapp works completely as expected on its own.

But when opening these webapps in different browser tabs and flipping between them, which is a requirement, each time I switch from one tab to the other and do something that requires an API request, I get a 401-unauthorised response, which causes the AuthExpiredInterceptor to trigger a re-login. This happens when flipping between tabs in both directions. Most times it redirects right back to the application without requiring me to actually enter a username/password, but the problem is that any data entered into the browser is lost.

On my local dev machine, the apps are running on different ports (8080 and 8090), but this cross-interference effect is also seen when running on a server. As these are totally separate monolith applications, it is puzzling why they should interact in this way. I suspect it has to do with some aspect of spring security that I am not understanding.

I tried checking the OKTA settings for the two apps in case there was something that could explain this interaction between them, but could not find anything obvious, which is what I expected as these are represented as totally separate web applications in OKTA. I considered trying to troubleshoot the spring security config (security filter chain), but I am no spring security expert, so I was hoping for some help/direction before doing so.

Any help and insights are greatly appreciated.

4
  • When you say both apps use the Okta Sign-In Widget, are you doing something different than the default OAuth configuration that JHipster ships with? Jun 28 at 14:03
  • Thanks for your reply, Matt. No, we're using the standard Jhipster config. I only mentioned the okta widget to indicate that we're not doing anything out of the ordinary.
    – G Ray-Co
    Jun 28 at 19:25
  • I think you might be seeing conflicts locally because the session cookie might be shared across localhost. My gut tells me the port should make them unique, but it might not. If you deploy them to separate domains (e.g. on Heroku), do you still have issues? Jun 28 at 20:29
  • Thanks Matt. I think you might have hit the nail on the head. I would like to do more extensive tests to properly confirm, but an initial quick test (running one app on localhost and the other on our server domain) supports your perspective. Thanks again for the insight - much appreciated.
    – G Ray-Co
    Jun 29 at 9:00

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.