OneLogin session_via_api_token and Chrome

Question

I am getting a session token via an ajax call. This in turn calls the API method https://api.us.onelogin.com/api/1/login/auth

$.post("onelogin.ashx?action=sessiontoken", data, function (s) {
                    $("#session_token").val(s);
 $("#frmSubmit").submit();
});
 <form action="https://admin.us.onelogin.com/session_via_api_token" method="POST" id="frmSubmit">
            <input type="hidden" id="session_token" name="session_token" value="">
            <input type="submit" placeholder="GO">
            <input id="auth_token" type="hidden">
        </form>

In IE and Firefox the user is now logged in. session_via_api_token returns response header "Location" with my original page URL.

In Chrome the user is not logged in and the response header "Location" is https://app.onelogin.com/login

I have a feeling it is a problem with cookies but can't figure out what. Any ideas?

Can you provide some network trace details? This is supposed to log the user in and then do an instant redirect back to the the referer[sic]- en.wikipedia.org/wiki/HTTP_referer Usually this behavior happens when something goes wrong with the parsing of the session_token and a network request trace should reveal what. BTW: A CORS compatible version of this endpoint is coming soon, and that should greatly simplify this. — John Offenhartz
Facing the same issue. Our working production environment broke a couple of days back and have wasted over 20hrs verifying each step again. Redirect not happening on FF38.0, Chrome latest, Chromium latest on Ubuntu systems. On IE Windows it is working. @JohnOffenhartz can you please explain in detail what kind of network trace you expect us to provide? Do you need the request/response header details? ( The one which gives 200 OK but does not redirect back?) — crazydiv

khanhqnu khanhqnu · Accepted Answer · 2020-03-22T04:08:54

I have same issue with session_via_api_token on Chrome lastest. Redirect on IE, MS Edge, FF are working. I'm using code to add session to browser:

function makeCors(session_token) {
   var xhr = new XMLHttpRequest();
   xhr.withCredentials = true;
   method = "POST";
   var url = "https://<your_subdomain>.onelogin.com/session_via_api_token";
   xhr.open(method, url, true);
   xhr.setRequestHeader("Content-Type", "application/json");
   body = {"session_token": session_token};
   xhr.send(JSON.stringify(body));
 };

OneLogin session_via_api_token and Chrome

1 Answers