[BUG] Hard Reload when a Incorrect API is executed from the Dev Tools

[Utkarsh-Aga]

Describe the bug

Hello Team, Starting from the OSD v2.5.0, in the Dev Tools when an Invalid/Incorrect API is executed from the Dev Tools, there is a hard reload of the page, which causes the actual error getting vanished quickly causing uncertainty with the end user.

To Reproduce
Go to the Dev Tools.

1. Run any incorrect API [For example - POST _cluster/settings]
2. A hot reload of the page _dashboards/app/dev_tools#/console can be observed.

Expected behavior
Ideally, if the user is running the API which is incorrect, the actual error message should be displayed as observed in OSD v2.3

Dashboards Version
Observed issue with OSD v2.5.0 and v.2.7.0

OSDv2.7.mov

The behaviour was expected with OSD v.2.3.0, as observed below -

OSDv2.3.mov

[ananzh]

@kristenTian could you verify if this issue is due to MD update new client?

[zhongnansu]

@Utkarsh-Aga
Hi, we've done a bunch of changes to dev tool console starting from 2.5. I tried to send an invalid request using latest version of OSD. The issue doesn't appear, and the page doesn't reload, error message is preserved. Could you update to the latest version and verify again?
Also you can try our demo website, which uses the latest version of OSD https://playground.opensearch.org/app/dev_tools#/console

[Utkarsh-Aga]

Hello @zhongnansu, I tried using the OSD v2.8 and the error message seems to be preserved, but for the Amazon OpenSearch Service Managed Cluster this does not seems to be the case.
Note - The above video's are shared for the OpenSearch Dashboard for the Managed Cluster.

[zhongnansu]

Confirming that OSS side doesn't have the issue, no matter version. Issue might only be related to Amazon OpenSearch Service. For that I suggest you reach out to their customer support to report the issue

[zhongnansu]

@kristenTian could you verify if this issue is due to MD update new client?

it shouldn't be

[joshuali925]

this happens because of this line in security dashboards, all requests are intercepted and triggers this callback, to ask user to log-in if response is 401
https://github.com/opensearch-project/security-dashboards-plugin/blob/eee08a5f1d91850c741a0085ea5f2beccaf0c343/public/utils/logout-utils.tsx#L40

it doesn't seem to happen in OSS because devtool returns 405 instead of 401. If a request returns 401, doesn't matter in devtools or AOS or OSS, OSD should refresh

but it's weird why in 2.3.0 the response is 401 but OSD didn't refresh, did devtools recently switched to use the core http client?

[kristenTian]

this happens because of this line in security dashboards, all requests are intercepted and triggers this callback, to ask user to log-in if response is 401 https://github.com/opensearch-project/security-dashboards-plugin/blob/eee08a5f1d91850c741a0085ea5f2beccaf0c343/public/utils/logout-utils.tsx#L40

it doesn't seem to happen in OSS because devtool returns 405 instead of 401. If a request returns 401, doesn't matter in devtools or AOS or OSS, OSD should refresh

but it's weird why in 2.3.0 the response is 401 but OSD didn't refresh, did devtools recently switched to use the core http client?

OpenSearch-Dashboards/src/plugins/console/public/lib/opensearch/opensearch.ts

Line 51 in 1d41cfe

return await http.post<HttpResponse>('/api/console/proxy', {

[joshuali925]

OpenSearch-Dashboards/src/plugins/console/public/lib/opensearch/opensearch.ts

Line 51 in 1d41cfe

return await http.post<HttpResponse>('/api/console/proxy', {

i see, seems #3080 triggered the issue

probably the fix is to make sure 401 responses http client receives are actual authentication errors, and POST _cluster/settings should return 405. In opensearch it already does

curl -XPOST localhost:9200/_cluster/settings
{"error":"Incorrect HTTP method for uri [/_cluster/settings] and method [POST], allowed: [GET, PUT]","status":405}

so need to find what changed it

[kristenTian]

OpenSearch-Dashboards/src/plugins/console/public/lib/opensearch/opensearch.ts

Line 51 in 1d41cfe

return await http.post<HttpResponse>('/api/console/proxy', {

i see, seems #3080 triggered the issue

probably the fix is to make sure 401 responses http client receives are actual authentication errors, and POST _cluster/settings should return 405. In opensearch it already does

curl -XPOST localhost:9200/_cluster/settings
{"error":"Incorrect HTTP method for uri [/_cluster/settings] and method [POST], allowed: [GET, PUT]","status":405}

so need to find what changed it

Thanks @joshuali925, this status code changes seems a specific change with AOS then.

[kristenTian]

Closing the issue, please follow up with Amazon OpenSearch Service with the above investigation context.