Session State Missing when Opening Links in New Tab

[danmasta]

Describe the bug
Opening links in the vault ui in a new tab causes session state to be lost and redirects the user back to login. The old tab remains functional, but the new tab is logged out.

I noticed in the network console the new tab had 403 errors for: https://$VAULT_HOST/v1/sys/internal/ui/resultant-acl

Server logs showed two errors:

{"time":"2022-05-29T06:15:33.841540309Z","type":"request","auth":{"token_type":"default"},"request":{"id":"c5b7c68a-4723-683c-3ed0-00f8d637c02b","operation":"read","mount_type":"system","namespace":{"id":"root"},"path":"sys/internal/ui/resultant-acl","remote_address":"10.36.1.10","remote_port":47956},"error":"permission denied"}
{"time":"2022-05-29T06:15:33.841681588Z","type":"response","auth":{"token_type":"default"},"request":{"id":"c5b7c68a-4723-683c-3ed0-00f8d637c02b","operation":"read","mount_type":"system","namespace":{"id":"root"},"path":"sys/internal/ui/resultant-acl","remote_address":"10.36.1.10","remote_port":47956},"response":{"mount_type":"system","data":{"error":"hmac-sha256:4192e1c910f40c13aa19fc38eac70e7611df0c547652ad76bce4355849618489"}},"error":"1 error occurred:\n\t* permission denied\n\n"}

I started looking at session state for both tabs and noticed in the old tab the Session Storage state looked like:

vault:ui-tutorial-state="idle"
selectedAuth=oidc
vault-token☃1=$TOKEN_JSON

And the new tab Session Storage state looks like this:

vault:ui-tutorial-state="idle"

It looks like the login session state is getting destroyed somehow on opening a new tab. Another interesting thing is that both the new tab and old tab had the same data in Local Storage, which both have a json vault-token, but Session Storage was changed in the new tabs and were missing the vault-token value.

To Reproduce
Steps to reproduce the behavior:

1. Login to vault
2. Open any link in a new tab
3. You'll be redirected to the login page
4. Check console network tab to see 403 error

Expected behavior
Opening hyper links in a new tab should work and the user remain logged in

Environment:

• Vault Server Version: 1.10.3
• Vault CLI Version: Vault v1.10.3 (af866591ee60485f05d6e32dd63dde93df686dfb)
• Server Operating System/Architecture: Docker image vault:1.10.3
• Tested in both Chrome and Vivaldi browsers

Vault server configuration file(s):

Additional context

[maxb]

It sounds like you have independently discovered #15311

[danmasta]

@maxb Yeah that looks like the same thing. Looks like a result from this commit: #14054

[danmasta]

According to the changelog it looks like this landed in v1.10.0

[heatherezell]

I'm going to go ahead and close this as a duplicate of #15311. Thanks for your patience!