Method handleSessionPOST

rest/session_api.go:44–85

POST /_session creates a login session and sets its cookie

()

// POST /_session creates a login session and sets its cookie
func (h *handler) handleSessionPOST() error {
	err := h.checkLoginCORS()
	if err != nil {
		return err
	}

	oneTime := h.getBoolQuery("one_time")

	// NOTE: handleSessionPOST doesn't handle creating users from OIDC - checkPublicAuth calls out into AuthenticateUntrustedJWT.
	// Therefore, if by this point `h.user` is guest, this isn't creating a session from OIDC.
	if h.db.Options.DisablePasswordAuthentication && (h.user == nil || h.user.Name() == "") {
		return ErrLoginRequired
	}
	user, err := h.getUserFromSessionRequestBody()

	ttl := defaultSessionTTL
	if oneTime {
		ttl = oneTimeSessionTTL
	}
	var sessionID string
	// If we fail to get a user from the body and we've got a non-GUEST authenticated user, create the session based on that user
	if user == nil && h.user != nil && h.user.Name() != "" {
		sessionID, err = h.makeSessionWithTTL(h.user, ttl, oneTime)
		if err != nil {
			return err
		}
		user = h.user
	} else if err != nil {
		return err
	} else {
		sessionID, err = h.makeSessionWithTTL(user, ttl, oneTime)
		if err != nil {
			return err
		}
	}
	if oneTime {
		h.writeJSON(h.formatSessionResponse(user, sessionID))
	} else {
		h.writeJSON(h.formatSessionResponse(user, ""))
	}
	return nil
}

func (h *handler) getUserFromSessionRequestBody() (auth.User, error) {