Tell Paskia SSO not to renew session on WebSocket connections where we cannot pass back the refreshed cookie.

2026-08-11 02:08:01 +00:00
parent fdc4fe0a3e
commit 3bad311e35
2 changed files with 12 additions and 2 deletions
@@ -40,7 +40,9 @@ async def watch(req, ws):
    if sso.paskia_enabled():
        # SSO auth: call validation to get user info (don't enforce auth in public mode)
        try:
-            await sso.validate_sso_request(req)
+            # WebSocket cannot forward Set-Cookie, so ask the auth backend not to
+            # renew the session here; renewal happens on the HTTP side instead.
+            await sso.validate_sso_request(req, renew=False)
        except Exception as e:
            logger.debug("watch SSO validation failed: %s", e)
        if sso_user := getattr(req.ctx, "sso_user", None):