outpost/proxyv2: revalidate auth if session fails to load (cherry-pick #18063 to version-2025.12)

[authentik-automation]

Cherry-pick of #18063 to version-2025.12 branch.

Original PR: #18063
Original Author: @chetan
Cherry-picked commit: 3f1a0f8

[netlify]

✅ Deploy Preview for authentik-integrations ready!

Name	Link
🔨 Latest commit	8f31b20
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-integrations/deploys/6984dab5d979c70007178cf3
😎 Deploy Preview	https://deploy-preview-20059--authentik-integrations.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[codecov]

❌ 1 Tests Failed:

Tests completed	Failed	Passed	Skipped
2884	1	2883	4

View the top 1 failed test(s) by shortest run time

tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit::test_authorization_consent_implied

Stack Traces | 121s run time

self = <unittest.case._Outcome object at 0x7fbe1b0e5fd0>
test_case = <tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>
subTest = False

    @contextlib.contextmanager
    def testPartExecutor(self, test_case, subTest=False):
        old_success = self.success
        self.success = True
        try:
>           yield

.../hostedtoolcache/Python/3.13.11............/x64/lib/python3.13/unittest/case.py:58: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>
result = <TestCaseFunction test_authorization_consent_implied>

    def run(self, result=None):
        if result is None:
            result = self.defaultTestResult()
            startTestRun = getattr(result, 'startTestRun', None)
            stopTestRun = getattr(result, 'stopTestRun', None)
            if startTestRun is not None:
                startTestRun()
        else:
            stopTestRun = None
    
        result.startTest(self)
        try:
            testMethod = getattr(self, self._testMethodName)
            if (getattr(self.__class__, "__unittest_skip__", False) or
                getattr(testMethod, "__unittest_skip__", False)):
                # If the class or method was skipped.
                skip_why = (getattr(self.__class__, '__unittest_skip_why__', '')
                            or getattr(testMethod, '__unittest_skip_why__', ''))
                _addSkip(result, self, skip_why)
                return result
    
            expecting_failure = (
                getattr(self, "__unittest_expecting_failure__", False) or
                getattr(testMethod, "__unittest_expecting_failure__", False)
            )
            outcome = _Outcome(result)
            start_time = time.perf_counter()
            try:
                self._outcome = outcome
    
                with outcome.testPartExecutor(self):
                    self._callSetUp()
                if outcome.success:
                    outcome.expecting_failure = expecting_failure
                    with outcome.testPartExecutor(self):
>                       self._callTestMethod(testMethod)

.../hostedtoolcache/Python/3.13.11............/x64/lib/python3.13/unittest/case.py:651: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>
method = <bound method TestProviderOAuth2OIDCImplicit.test_authorization_consent_implied of <tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>>

    def _callTestMethod(self, method):
>       if method() is not None:

.../hostedtoolcache/Python/3.13.11............/x64/lib/python3.13/unittest/case.py:606: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>
args = (), kwargs = {}

    @wraps(func)
    def wrapper(self: TransactionTestCase, *args, **kwargs):
        """Run test again if we're below max_retries, including tearDown and
        setUp. Otherwise raise the error"""
        nonlocal count
        try:
>           return func(self, *args, **kwargs)

tests/e2e/utils.py:405: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>,)
kwargs = {}, file = 'default/flow-default-invalidation-flow.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Invalidation flow\nentries:\n- attrs:\n    designation: invalidation\n    na...0\n    stage: !KeyOf default-invalidation-logout\n    target: !KeyOf flow\n  model: authentik_flows.flowstagebinding\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>,)
kwargs = {}
file = 'default/flow-default-provider-authorization-implicit-consent.yaml'
content = 'version: 1\nmetadata:\n  name: Default - Provider authorization flow (implicit consent)\nentries:\n- attrs:\n    desi...henticated\n  identifiers:\n    slug: default-provider-authorization-implicit-consent\n  model: authentik_flows.flow\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>,)
kwargs = {}, file = 'system/providers-oauth2.yaml'
content = 'version: 1\nmetadata:\n  labels:\n    blueprints.goauthentik.io/system: "true"\n  name: System - OAuth2 Provider - Sc... application the ability to access the authentik API\n        # on behalf of the authorizing user\n        return {}\n'

    @wraps(func)
    def wrapper(*args, **kwargs):
        for file in files:
            content = BlueprintInstance(path=file).retrieve()
            Importer.from_string(content).apply()
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:25: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

args = (<tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>,)
kwargs = {}, config = <AuthentikCryptoConfig: authentik_crypto>

    @wraps(func)
    def wrapper(*args, **kwargs):
        config = apps.get_app_config(app_name)
        if isinstance(config, ManagedAppConfig):
            config._on_startup_callback(None)
>       return func(*args, **kwargs)

.../blueprints/tests/__init__.py:43: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>

    @retry()
    @apply_blueprint(
        "default/flow-default-authentication-flow.yaml",
        "default/flow-default-invalidation-flow.yaml",
    )
    @apply_blueprint("default/flow-default-provider-authorization-implicit-consent.yaml")
    @apply_blueprint("system/providers-oauth2.yaml")
    @reconcile_app("authentik_crypto")
    def test_authorization_consent_implied(self):
        """test OpenID Provider flow (default authorization flow with implied consent)"""
        sleep(1)
        # Bootstrap all needed objects
        authorization_flow = Flow.objects.get(
            slug="default-provider-authorization-implicit-consent"
        )
        provider = OAuth2Provider.objects.create(
            name=self.application_slug,
            client_type=ClientTypes.CONFIDENTIAL,
            client_id=self.client_id,
            client_secret=self.client_secret,
            signing_key=create_test_cert(),
            redirect_uris=[
                RedirectURI(RedirectURIMatchingMode.STRICT, "http://localhost:9009/implicit/")
            ],
            authorization_flow=authorization_flow,
        )
        provider.property_mappings.set(
            ScopeMapping.objects.filter(
                scope_name__in=[
                    SCOPE_OPENID,
                    SCOPE_OPENID_EMAIL,
                    SCOPE_OPENID_PROFILE,
                    SCOPE_OFFLINE_ACCESS,
                ]
            )
        )
        provider.save()
        Application.objects.create(
            name=self.application_slug,
            slug=self.application_slug,
            provider=provider,
        )
        self.setup_client()
    
        self.driver.get("http://localhost:9009/implicit/")
        self.wait.until(ec.title_contains("authentik"))
        self.login()
    
>       body = self.parse_json_content()

tests/e2e/test_provider_oidc_implicit.py:153: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>
context = None, timeout = 10

    def parse_json_content(
        self, context: WebElement | None = None, timeout: float | None = 10
    ) -> JSONType:
        """
        Parse JSON from a Selenium element's text content.
    
        If `context` is not provided, defaults to the <body> element.
        Raises a clear test failure if the element isn't found, the text doesn't appear
        within `timeout` seconds, or the text is not valid JSON.
        """
        use_body = context is None
        wait_timeout = timeout or self.wait_timeout
    
        def get_context() -> WebElement:
            """Get or refresh the context element."""
            if use_body:
                return self.driver.find_element(By.TAG_NAME, "body")
            return context
    
        def get_text_safely() -> str:
            """Get element text, re-finding element if stale."""
            for _ in range(5):
                try:
                    return get_context().text.strip()
                except StaleElementReferenceException:
                    sleep(0.5)
            return get_context().text.strip()
    
        def get_inner_html_safely() -> str:
            """Get innerHTML, re-finding element if stale."""
            for _ in range(5):
                try:
                    return get_context().get_attribute("innerHTML") or ""
                except StaleElementReferenceException:
                    sleep(0.5)
            return get_context().get_attribute("innerHTML") or ""
    
        try:
            get_context()
        except NoSuchElementException:
            self.fail(
                f"No element found (defaulted to <body>). Current URL: {self.driver.current_url}"
            )
    
        wait = WebDriverWait(self.driver, wait_timeout)
    
        try:
            wait.until(lambda d: len(get_text_safely()) != 0)
        except TimeoutException:
            snippet = get_text_safely()[:500].replace("\n", " ")
            self.fail(
                f"Timed out waiting for element text to appear at {self.driver.current_url}. "
                f"Current content: {snippet or '<empty>'}"
            )
    
        body_text = get_text_safely()
        inner_html = get_inner_html_safely()
    
        if "redirecting" in inner_html.lower():
            try:
                wait.until(lambda d: "redirecting" not in get_inner_html_safely().lower())
            except TimeoutException:
                snippet = get_text_safely()[:500].replace("\n", " ")
                inner_html = get_inner_html_safely()
    
                self.fail(
                    f"Timed out waiting for redirect to finish at {self.driver.current_url}. "
                    f"Current content: {snippet or '<empty>'}"
                    f"{inner_html or '<empty>'}"
                )
    
            inner_html = get_inner_html_safely()
            body_text = get_text_safely()
    
        snippet = body_text[:500].replace("\n", " ")
    
        if not body_text.startswith("{") and not body_text.startswith("["):
>           self.fail(
                f"Expected JSON content but got non-JSON text at {self.driver.current_url}: "
                f"{snippet or '<empty>'}"
                f"{inner_html or '<empty>'}"
            )

tests/e2e/utils.py:232: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.e2e.test_provider_oidc_implicit.TestProviderOAuth2OIDCImplicit testMethod=test_authorization_consent_implied>
msg = 'Expected JSON content but got non-JSON text at http://localhost:9009/implicit/#access_token=eyJhbGciOiJSUzI1NiIsImtpZ...en_type=Bearer&expires_in=3600&state=6d5c1eeadb5143e39a465e02ea6234fe: <empty>\n    <pre id="loginResult"></pre>\n\n\n'

    def fail(self, msg=None):
        """Fail immediately, with the given message."""
>       raise self.failureException(msg)
E       AssertionError: Expected JSON content but got non-JSON text at http://localhost:9009/implicit/#access_token=eyJhbGciOiJSUzI1NiIsImtpZCI6Ijc5OWVjMWEyNmMxYzYzZWNjOTZlNWM3MjhiNzkyNmMxIiwidHlwIjoiSldUIn0.eyJpc3MiOiJodHRwOi8vMTAuMS4wLjIyNzo0NDQyNy9hcHBsaWNhdGlvbi9vL3Rlc3QvIiwic3ViIjoiMDlmZDcwMjdiMmE5YjVmOWJjOWJjZTBiMDU5OTkyYWU0ZDJjNTk4MmI2NjI3YzIwZDY3MzFlNTFkNTc5MDY3MSIsImF1ZCI6IkRNYXdkNzExYlVSNUtpWGhnUGN5WlpCMHVjTzBSU3J4bEZJWERnM3oiLCJleHAiOjE3NzAzMTg1OTEsImlhdCI6MTc3MDMxNDk5MSwiYXV0aF90aW1lIjoxNzcwMzE0OTkwLCJhY3IiOiJnb2F1dGhlbnRpay5pby9wcm92aWRlcnMvb2F1dGgyL2RlZmF1bHQiLCJhbXIiOlsicHdkIl0sIm5vbmNlIjoiMTg0ZTY3NjcyNTI5NDg1YWFiNTViYjc4NTg0NzZlZTYiLCJzaWQiOiJiY2ZhNGMzZmYwNDFmOTBmNWQ4OGNiNWZjZjlmNjA1YWJjMWE1NGQzZGE4ZDIyNzE4MmMyYTE2OGMxNzJhNDhjIiwiZW1haWwiOiJBanRrQ2tDS1ZvSGRTcjBnT3dCRUBnb2F1dGhlbnRpay5pbyIsImVtYWlsX3ZlcmlmaWVkIjpmYWxzZSwibmFtZSI6IkFqdGtDa0NLVm9IZFNyMGdPd0JFIiwiZ2l2ZW5fbmFtZSI6IkFqdGtDa0NLVm9IZFNyMGdPd0JFIiwicHJlZmVycmVkX3VzZXJuYW1lIjoiQWp0a0NrQ0tWb0hkU3IwZ093QkUiLCJuaWNrbmFtZSI6IkFqdGtDa0NLVm9IZFNyMGdPd0JFIiwiZ3JvdXBzIjpbIkFqdGtDa0NLVm9IZFNyMGdPd0JFIl0sImF6cCI6IkRNYXdkNzExYlVSNUtpWGhnUGN5WlpCMHVjTzBSU3J4bEZJWERnM3oiLCJ1aWQiOiJheHEyYWJ5ZEVodTF5SThPTm9DQnpSbW1RSWRHNmpqSk5uWUxzeDVSIiwic2NvcGUiOiJvcGVuaWQgcHJvZmlsZSBlbWFpbCJ9.U6fKXFzPEorxjPD-YblfkOGRZp33kMjUKi67zUmsknBqe0Rz5iIoA7uXRthLFvhn1CrIN_Q58XoRD-ivwQ-xjQ0nwTA2x9nJ6artfleja3J2DMYx69Hg-V_TSWq1DzxEcgoezMHCa5y41qSV-MNzx-Nt5E_yC89u_mUAZbYV9y8HNX_JWoB_tzQsX-dDQvOHRsscw0hMSmduERLkqdqGxC2Lt71IUFYFtPNzXUyHPU0AU68Iqq70mHo_U8ose4W761R801Bt6cwQM4NBmkkQjTkLW5zqRswVFwx3Bl06N_SJSTRur5SMFSjDOnOyhEYeAN6sbHzBmGvfsJcAlMLSUoxmvzzbhfyd-mE6EfbR2lVQkpIKpGem0NuKAzGVKDa0WSLlqyj4ZZceSCUNs11AO30YjHiDGXZHD5LbScDcAQUrealW21Dr_77uJr_TR2IieSOUemL3U6WgMhRKEFmgt8DtCnIusW04ZgxSSTQ8Yw4XZZB3Ol-dZETNkU3FQbmNXx8nA3y-uTCOnGrkfdkCWJmrhd8-BpH4E6-l4CSPIS3rue3PW52RcoFW3wAIrk7ejNBrap50n57fXydv5HPi5xuEMC1NeQEnHbUZ-c9Hx_FCjrc-mTpnnYxQXjuhd6TDU_JGJ89pqp81PyslaoZ7zC_X0UMvtoqCk5Xe84V7aFs&id_token=eyJhbGciOiJSUzI1NiIsImtpZCI6Ijc5OWVjMWEyNmMxYzYzZWNjOTZlNWM3MjhiNzkyNmMxIiwidHlwIjoiSldUIn0.eyJpc3MiOiJodHRwOi8vMTAuMS4wLjIyNzo0NDQyNy9hcHBsaWNhdGlvbi9vL3Rlc3QvIiwic3ViIjoiMDlmZDcwMjdiMmE5YjVmOWJjOWJjZTBiMDU5OTkyYWU0ZDJjNTk4MmI2NjI3YzIwZDY3MzFlNTFkNTc5MDY3MSIsImF1ZCI6IkRNYXdkNzExYlVSNUtpWGhnUGN5WlpCMHVjTzBSU3J4bEZJWERnM3oiLCJleHAiOjE3NzAzMTg1OTEsImlhdCI6MTc3MDMxNDk5MSwiYXV0aF90aW1lIjoxNzcwMzE0OTkwLCJhY3IiOiJnb2F1dGhlbnRpay5pby9wcm92aWRlcnMvb2F1dGgyL2RlZmF1bHQiLCJhbXIiOlsicHdkIl0sIm5vbmNlIjoiMTg0ZTY3NjcyNTI5NDg1YWFiNTViYjc4NTg0NzZlZTYiLCJhdF9oYXNoIjoieW1mNlkxcWRnYUVCdl9ZUVZiM05lZyIsInNpZCI6ImJjZmE0YzNmZjA0MWY5MGY1ZDg4Y2I1ZmNmOWY2MDVhYmMxYTU0ZDNkYThkMjI3MTgyYzJhMTY4YzE3MmE0OGMiLCJlbWFpbCI6IkFqdGtDa0NLVm9IZFNyMGdPd0JFQGdvYXV0aGVudGlrLmlvIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJuYW1lIjoiQWp0a0NrQ0tWb0hkU3IwZ093QkUiLCJnaXZlbl9uYW1lIjoiQWp0a0NrQ0tWb0hkU3IwZ093QkUiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJBanRrQ2tDS1ZvSGRTcjBnT3dCRSIsIm5pY2tuYW1lIjoiQWp0a0NrQ0tWb0hkU3IwZ093QkUiLCJncm91cHMiOlsiQWp0a0NrQ0tWb0hkU3IwZ093QkUiXX0.xayRqu4j0o5NvwmjTqj6iLT9RyFZvcbDW4Cdx2dnvE3P2dqvm2M0SNgRLeBY_pPf2A7NQtXmWQ65E2pbhRQhC1AGV5mxw7M8H7R4DlZb-3buZKskSzC7baeLicXQKyUKXaxpRFSXFvP9NN2YlByJuvlh4f4twyOwdxuwwTcclP9yIMAVND2RHQlpkQ_dUw8xa2mDmAS-pMXRb-QqSuW4CzfBh5jGiOCGxUxgLIcasvYm4C-2gnIcLXLCEIqi4mswVAp4SEktbyFG6HyiMK7glt50KG-ZwIybreyJugAxyNsm2PXlB-Clsu9IIqKRR9DvvmJlx9oGdiabCHO5tQit_phmt9FLJkFNZ5wc93S4IZ-0U2ryyoXLnHVpC5xenvd05KtihIND1Tr5XpAFdAtfO0Dd4eKuKH_ChAJRkH7vI5pEN_6ptnFjBxb5Bbh8k_YIHjqxK_Kl4sJVg0gOI5AnlsLWo-UPkHogC2_eSJ6Z7huVwoKTjZdei544tBX0OCU49zj86aPR7SXPWzGuoltPfQEOWL79ezOi9TeI9Sw4VhzRCVLjR6GbHomT53fpXltSbo-lnGOjKIoS6cU39iZL56TpqivPwhGgCOZRu6dDLTu6xKZXeTNodlG4UFJDQmtJseiX0Gw-UEVQYU3A6c-LR76I4p__KVpAzLrMRMSGTPg&token_type=Bearer&expires_in=3600&state=6d5c1eeadb5143e39a465e02ea6234fe: <empty>
E           <pre id="loginResult"></pre>

.../hostedtoolcache/Python/3.13.11............/x64/lib/python3.13/unittest/case.py:732: AssertionError

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}