I have 3 views like this:
def download_file(request, doc):
if not request.session.get('is_authenticated'):
return redirect(f"{reverse('pingfed_auth')}?next={request.get_full_path()}")
return downloadfile(doc)
def pingfed_auth(request):
original_url = request.GET.get('next') or 'home'
request.session['original_url'] = original_url
return redirect('Some third party authentication')
def redirect_pingfed_auth(request):
if request.method == 'POST':
request.session['is_authenticated'] = True
request.session['username'] = get_username_from_saml(request.POST.get('SAMLResponse'))
return redirect(request.session['original_url'] if 'original_url' in request.session else 'home')
Where pingfed_auth start the authentication and redirect_pingfed_auth is the callback URL from that thrid-party authentication. However, the session doesn't work in chrome Incognito mode. I can't see any session from browser console, and I can't get redirect correctly. But I do see the session is stored properly in the database. Is that because Incognito mode block the session after redirect to third party site or something else?
In incognito mode it blocks third-party
cookies if your authentication flow relies on cookies
that are considered "third-party" that is - ( cookies set by domains other than your own during the authentication process), these cookies may be blocked. This can result in the session not being recognized after the redirect back from the third-party authentication provider.