How to know if user is currently logged in

Plone Support
1

Hi,
I have developed a dashboard that is embedded as an iframe in a Plone site. I would like to hide certain content of the dashboard, depending on whether the user currently visiting the site is logged in or not. I am assuming that in order to do this I need to use an endpoint. At the moment I have this:

        url = f"http://{url}/@users/{username}"
        cmd = [
            "curl", "-i", url,
            "-H", "Accept: application/json",
            "--user", f"{username}:{password}"
        ]
        result = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
        output = result.stdout.splitlines()

Which returns some information about the user, but I don't know how to get its current status (logged in or not).
Thank you in advance,
Alba

2

There is nothing like being " logged in". HTTP is stateless and the portal does not track if you are logged in or not. A HTTP requests provides the authentication information/cookie or not. On the backend side, you can use plone.api.user.get_current() for checking for the current user.

1 Like
3

Is the dashboard on the same (Plone) site?
If it is, you can use 'get current' to see if the user is anon.
(with javscript it should also be possible to check CSS classes ( .userrole-authenticated ))

PS: If it is 'the same site', I dont think you should use an iframe.

4

It is not in the same site, it is an external running instance.

5

Then it is like zopyx said

6

You can create the iframe src parameter with the current user, like

<iframe src="https://myembedsite.com/page?user=auser" ....

and you can read the user from the url.

A better solution is to use the plone site as the auth provider for the iframe site, using `plone.session': plone.session/plone/session/tktauth.py at master · plone/plone.session · GitHub

See Also:

1 Like
7

Would it be safe to get the current user with plone.api.user.get_current(), and pass the information through the iframe as query parameters?

8

Yes, if you trust site users. Otherwise, everybody can edit the html dom and replace the user. The iframe site should check if the user in the parameter is the same that is logged via tkt session.

9

Is it a reason you use an iframe? Would it not be better/safer to use plone restapi and get user info etc. (I assume you have two Plone sites)

10

I don't have two Plone sites, the one that is within the iframe is a dashboard made with Plotly Dash.

11

Hey @albavilanova ,
Implementing a SSO system between two different systems is hard, and at least, it requires for you to have dev access to both sides. Is that the case? can you develop in the Plone site and in the dashboard app?

Second, the level of security that you want to achieve is also key. Do you trust in your logged in users? eg. using the iframe querystring might work, provided that nobody is going to impresonate the user (by forging the URL), or hack your dashboard, by appending the querystring to the URL for accessing it.

Parlo catalĂ  si vols contacta'm per privat o per les vies habituals.

Cheers,
V.

12

I am the dashboard developer and don't have access to the Plone site at the moment, but I am in direct touch with the Plone site developer as we work in the same company.

I trust the logged in users, as registrations are accepted on a one-to-one basis, and they are not open to the general public.

As you say, I think somebody might forge the URL and therefore using a querystring does not sound like the safest option.

We wanted to use the REST API but it seems like there is no method to retrieve the currently connected user at the moment (see issue 179 in plone.restapi in Github - I cannot add links)...

I guess the only option we have right now is to send a message with postMessage.

(Salut Victor!)

13

No, there's no such endpoint, basically because it would only work with a token, and, given a token, you have the means to get the user from the token with no call involved.

Also, I assume you are in Plone Classic, so you won't have such token (since classic does not need it). Are you adding the iframe via the editor or through a Mosaic tile. You could get the user from a small Plone development if you are using tiles for that, using plone.api.user. Once you get your user, you pass it to the iframe.

Any other solutions imply sharing the cookie between sites, and all that dance...

I don't know what you meant by postMessage...

Cheers,
V.

14

Just to close this, at the end we decided to include the login form inside the dashboard and call the REST API from Plone to know if the user exists having his credentials. It is not ideal, but I don't see any safer way. Thank you all for your comments!

15

I wonder if this is less of a Plone-specific need, and more of an iframe interaction problem; you might be able to:

  1. JavaScript (resource) in page in Plone site evaluates condition of $('body.userrole-authenticated') (body classes are injected in Plone for each user role) and existence of your iframe; if both of these evaluate to true, you could then:
  2. Use window.postMessage [1] with specified origin to pass a simple message indicating that (boolean?) status (or a list of roles, if you wanted to be more complete) into other-origin (dashboard) iframe.
  3. In your iframe, assuming plotly or other tools allow you to use JavaScript within them, receive message with data from passed message; validate origin of the message as a safeguard, then
  4. Within your non-Plone/other-origin iframe, use status and/or roles that you passed from parent page of iframe via postMessage to act as you need to.
1 Like