401 error on UI when login with wrong user or password

[mmartin24]

Issue

When an user enters wrong credentialls on ui, a 401 error appears

Steps to reproduce

• Deploy latest Epinio server version (v1.10.0-15-g47ee6f4e) and either of these ui images: ghcr.io/epinio/epinio-ui:v1.10.0-0.0.1 or ghcr.io/epinio/epinio-ui:latest-next
• Enter a wrong username / password and login

Observed behavior

The user is taken to an 401 error screen and then returned to the login screen

Screencast.from.06-10-23.09.29.42.mov

Error:

xhr.js:178     GET https://epinio.192.168.16.3.omg.howdoi.website/pp/v1/direct/r/ZThhPrryoUeUuimbk4Gb-G3-I9A/api/v1/namespaces 401 (Unauthorized)

Note: CLI handles correctly the message:

Ξ epinio-repos/epinio git:(main) ▶ epinio login -u admin https://epinio.192.168.16.3.omg.howdoi.website

🚢  Login to your Epinio cluster [https://epinio.192.168.16.3.omg.howdoi.website]
Password: 

⚠️  Certificate signed by unknown authority

|     KEY     |      VALUE      |
|-------------|-----------------|
| Issuer Name | CN=epinio-ca    |
| Common Name | epinio-ca       |
| Expiry      | 2024-January-04 |

Do you want to trust it (y/n): y

✔️  Trusting certificate for address https://epinio.192.168.16.3.omg.howdoi.website...

❌  error verifying credentials: error while connecting to the Epinio server: wrong password

Expected behavior

UI should handle it correctly not redirecting the user and displaying an error in the login page as before: Invalid username or password. Please try again.

Setup

Kubernetes Version: v1.25.4+k3s1
Epinio Server Version: v1.10.0-15-g47ee6f4e
Browser: Brave v1.58.135
UI Image: ghcr.io/epinio/epinio-ui:v1.10.0-0.0.1 or ghcr.io/epinio/epinio-ui:latest-next

[andreas-kupries]

From a talk in slack we are theorizing that the issue is as follows:

• We assume that the ui uses the /info endpoint after login to check if the entered credentials are correct or not.
• Before the recent changes in the server the /info endpoint was authenticated and served that purpose well.
• With the recent changes (#2604) the /info is not authenticated any longer.
• To the UI this change means it comes to believe that even bad credentials are ok.
  It then goes forward with actual work (like listing the namespaces), and then fails there with the bad credentials.
  And was not prepared for that, hence the 401.

@richard-cox ^ ping

[richard-cox]

@andreas-kupries you're 100% correct. we were using /info to check creds, which then always succeeded after the change (we requested) to make /info not require creds.

A PR is up now to use the new /me endpoint

[mmartin24]

Fixed issue.
CI tests previously failing passing now (ie: https://github.com/epinio/epinio-end-to-end-tests/actions/runs/6845007595)