From dd5a8275f107dbc54160fc271c3230096ba3707b Mon Sep 17 00:00:00 2001
From: Marcus Efraimsson <marcus.efraimsson@gmail.com>
Date: Fri, 1 Feb 2019 01:21:23 +0100
Subject: [PATCH 1/3] must return json response from /api/login/ping

Even though http error 401 was returned, the result was still a http 200
---
 pkg/api/login.go | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkg/api/login.go b/pkg/api/login.go
index 50c62e0835a..3f2d82a6c0f 100644
--- a/pkg/api/login.go
+++ b/pkg/api/login.go
@@ -78,12 +78,13 @@ func tryOAuthAutoLogin(c *m.ReqContext) bool {
 	return false
 }
 
-func (hs *HTTPServer) LoginAPIPing(c *m.ReqContext) Response {
-	if c.IsSignedIn || c.IsAnonymous {
-		return JSON(200, "Logged in")
+func (hs *HTTPServer) LoginAPIPing(c *m.ReqContext) {
+	if c.IsSignedIn || (c.AllowAnonymous && c.IsAnonymous) {
+		c.JsonOK("Logged in")
+		return
 	}
 
-	return Error(401, "Unauthorized", nil)
+	c.JsonApiErr(401, "Unauthorized", nil)
 }
 
 func (hs *HTTPServer) LoginPost(c *m.ReqContext, cmd dtos.LoginCommand) Response {

From bd830780250880f3c9920a5c1f5c467b3e5bdb2a Mon Sep 17 00:00:00 2001
From: Marcus Efraimsson <marcus.efraimsson@gmail.com>
Date: Fri, 1 Feb 2019 01:22:56 +0100
Subject: [PATCH 2/3] signout user if /api/login/ping returns 401 unauthorized

---
 public/app/core/services/backend_srv.ts | 37 +++++++++++++++++--------
 1 file changed, 26 insertions(+), 11 deletions(-)

diff --git a/public/app/core/services/backend_srv.ts b/public/app/core/services/backend_srv.ts
index 38d7f2b76cb..c73cc7661f5 100644
--- a/public/app/core/services/backend_srv.ts
+++ b/public/app/core/services/backend_srv.ts
@@ -1,6 +1,7 @@
 import _ from 'lodash';
 import coreModule from 'app/core/core_module';
 import appEvents from 'app/core/app_events';
+import config from 'app/core/config';
 import { DashboardModel } from 'app/features/dashboard/state/DashboardModel';
 
 export class BackendSrv {
@@ -103,10 +104,17 @@ export class BackendSrv {
       err => {
         // handle unauthorized
         if (err.status === 401 && this.contextSrv.user.isSignedIn && firstAttempt) {
-          return this.loginPing().then(() => {
-            options.retry = 1;
-            return this.request(options);
-          });
+          return this.loginPing()
+            .then(() => {
+              options.retry = 1;
+              return this.request(options);
+            })
+            .catch(err => {
+              if (err.status === 401) {
+                window.location.href = config.appSubUrl + '/logout';
+                throw err;
+              }
+            });
         }
 
         this.$timeout(this.requestErrorHandler.bind(this, err), 50);
@@ -184,13 +192,20 @@ export class BackendSrv {
 
         // handle unauthorized for backend requests
         if (requestIsLocal && firstAttempt && err.status === 401) {
-          return this.loginPing().then(() => {
-            options.retry = 1;
-            if (canceler) {
-              canceler.resolve();
-            }
-            return this.datasourceRequest(options);
-          });
+          return this.loginPing()
+            .then(() => {
+              options.retry = 1;
+              if (canceler) {
+                canceler.resolve();
+              }
+              return this.datasourceRequest(options);
+            })
+            .catch(err => {
+              if (err.status === 401) {
+                window.location.href = config.appSubUrl + '/logout';
+                throw err;
+              }
+            });
         }
 
         // populate error obj on Internal Error

From cfd8eb5167303afa7176d52c9d456a144bf537b5 Mon Sep 17 00:00:00 2001
From: Marcus Efraimsson <marcus.efraimsson@gmail.com>
Date: Mon, 4 Feb 2019 17:37:07 +0100
Subject: [PATCH 3/3] now /api/login/ping returns Response

---
 pkg/api/api.go   | 4 ++--
 pkg/api/login.go | 9 ++++-----
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/pkg/api/api.go b/pkg/api/api.go
index 07cb712f794..980706d8355 100644
--- a/pkg/api/api.go
+++ b/pkg/api/api.go
@@ -108,8 +108,8 @@ func (hs *HTTPServer) registerRoutes() {
 	r.Get("/api/snapshots-delete/:deleteKey", Wrap(DeleteDashboardSnapshotByDeleteKey))
 	r.Delete("/api/snapshots/:key", reqEditorRole, Wrap(DeleteDashboardSnapshot))
 
-	// api renew session based on remember cookie
-	r.Get("/api/login/ping", quota("session"), hs.LoginAPIPing)
+	// api renew session based on cookie
+	r.Get("/api/login/ping", quota("session"), Wrap(hs.LoginAPIPing))
 
 	// authed api
 	r.Group("/api", func(apiRoute routing.RouteRegister) {
diff --git a/pkg/api/login.go b/pkg/api/login.go
index 3f2d82a6c0f..50c62e0835a 100644
--- a/pkg/api/login.go
+++ b/pkg/api/login.go
@@ -78,13 +78,12 @@ func tryOAuthAutoLogin(c *m.ReqContext) bool {
 	return false
 }
 
-func (hs *HTTPServer) LoginAPIPing(c *m.ReqContext) {
-	if c.IsSignedIn || (c.AllowAnonymous && c.IsAnonymous) {
-		c.JsonOK("Logged in")
-		return
+func (hs *HTTPServer) LoginAPIPing(c *m.ReqContext) Response {
+	if c.IsSignedIn || c.IsAnonymous {
+		return JSON(200, "Logged in")
 	}
 
-	c.JsonApiErr(401, "Unauthorized", nil)
+	return Error(401, "Unauthorized", nil)
 }
 
 func (hs *HTTPServer) LoginPost(c *m.ReqContext, cmd dtos.LoginCommand) Response {