Arvados

My thoughts about this issue:

• The session cookie _arvados_workbench_session is a browser cookie and lives until the browser session terminates (and hence does not expire), but instead the contents of the cookie are stale. The cookie contains the aravados_api_token, which I think has expired.

• The application_controller -> set_thread_api_token, an around_filter, tries to setup an active user session using this expired token.

   load_api_token(session[:arvados_api_token]) 

• The API call invocation should hence fail and result in login prompt / SSO as needed.

I did the following tests to see if relogin is happening as expected when the cookie has an expired token.

• I added a workbench controller test that simulates a session cookie with expired token. The test "passes" and a redirection to login page is happening.

• Using my localhost workbench, I tested the following. Login to my workbench. Identify the current token. Update the record in my database for this token and set expires_at to a year ago. Navigate to a different page or reload same page in my workbench page. Looking at the workbench console log as well as workbench current token page, verify that the login process (SSO) is happening and a new token is created and the browser cookie is also updated. Tested with both Firefox and Chrome and in both cases I observed the expected behavior of login process upon encountering a session cookie with expired token.

• Based on these two tests, the session handling seems to work as expected in this scenario.