Grafana JWT, when refreshed in the browser (F5) in the dashboard, it redirects me to the login page

Grafana Authentication
,
1

I am using grafana v.9.3.2 since docker. I configured grafana with JWT, this is my grafana.ini

[server]
protocol = http
http_port = 3003
domain = qa-grafana.domain.com
root_url = https://qa-grafana.domain.com/

[session]
cookie_name = grafana_session
cookie_secure = false

[security]
admin_user = root
admin_password = root
cookie_samesite = disabled

[auth]
disable_login_form = true
signout_redirect_url= https://graf.auth.us-weast-1.amazoncognito.com/logout?client_id=1234&logout_uri=https://myapy.domain.com/users/logout

[auth.jwt]
enabled = true
enable_login_token = true
header_name = x-token-auth-qa
username_claim = sub
email_claim = sub
jwk_set_file = /tmp/jwks.json
auto_sign_up = true
url_login = true

  1. I am getting access to the grafana using:
    https://qa-grafana.domain.com/?auth_token=eyJraWQiOiI3S29xUjYwSlVsSVZaclhUenAzRWhpbEdnbTVPQVdqOW50K3V1UzdNK0cwPSIsImFsZyI&orgId=1

  2. I login correctly using the JWT

  3. I display the main menu of grafana

  4. I access one of my dashboards and it works correctly from the grafana controls
    But if I refresh (F5 or Reload this page option) from the chrome browser, it immediately redirects me to https://qa-grafana.domain.com/login

image
image522×607 27.5 KB

What is my mistake, what can I do to continue working with JWT and work correctly even if I refresh the page from the browser?

Thanks,

Dairo Cortes

2

My stupid guess is that your auth token is expired. Do a standard debugging: increase grafana log level and check the logs.

3

I met same issue, I guess.
The token is not expired, and also there is x-jwt-assertion header in request section. After click a dashboard, the auth_token already disappeared in url, but the header of jwt still there, now works fine. Then I refresh the page manually by clicking refresh button of browser, it went to login page.
If I manually put the query auth_token back, it works again.
Many thanks for any help.

4

Instead of passing jwt token in url, putting jwt in header before accessing grafana can avoid this issue.

1 Like