No longer able to check authentication without redirecting to login?

[skratzmeier]

Hi there,

we've been using the option to pass unauth_action = deny on to check authentication only but not redirect if no session is found (for paths of api endpoints only).
However since upgrading to the v 1.8.0, we see redirects on those paths as well.

Readme still states:

-- check session, do not redirect to auth if not already logged in but return an error instead
local res, err = require("resty.openidc").authenticate(opts, nil, "deny")

which is what we are using.

Does anyone know if there is a different way to configure this behaviour in the current version?

Best

[skratzmeier]

after some testing, pinning the lua-resty-session version to 4.0.5 seems to solve my issue.

FROM openresty/openresty:1.27.1.2-0-alpine-fat-amd64
RUN luarocks install lua-resty-session 4.0.5
RUN luarocks install lua-resty-openidc 1.8.0-1