fix: Catch errors when failing to verify JWTs

[rolodato]

Fixes #4982.

The issue as described is incorrect, as the SAML routes already use AllowAny. The problem is actually caused by get_validated_token returning an exception when called with an invalid JWT. We now catch any of these expected errors and gracefully fail the authentication instead.

This is completely untested.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

3 Skipped Deployments

Name	Status	Preview	Comments	Updated (UTC)
docs	⬜️ Ignored (Inspect)	Visit Preview		Mar 7, 2025 2:47pm
flagsmith-frontend-preview	⬜️ Ignored (Inspect)	Visit Preview		Mar 7, 2025 2:47pm
flagsmith-frontend-staging	⬜️ Ignored (Inspect)	Visit Preview		Mar 7, 2025 2:47pm

[github-actions]

Docker builds report

Image	Build Status	Security report
ghcr.io/flagsmith/flagsmith-api-test:pr-5153	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-e2e:pr-5153	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-api:pr-5153	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-frontend:pr-5153	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith:pr-5153	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-private-cloud:pr-5153	Finished ✅	Results ✅

[github-actions]

Uffizzi Preview deployment-61216 was deleted.

[codecov]

Codecov Report

Attention: Patch coverage is 95.55556% with 2 lines in your changes missing coverage. Please review.

Project coverage is 97.50%. Comparing base (9a58249) to head (b586ca2).
Report is 29 commits behind head on main.

Files with missing lines	Patch %	Lines
api/api_keys/models.py	0.00%	1 Missing ⚠️
api/organisations/urls.py	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5153      +/-   ##
==========================================
+ Coverage   97.47%   97.50%   +0.02%     
==========================================
  Files        1224     1224              
  Lines       42590    42623      +33     
==========================================
+ Hits        41515    41558      +43     
+ Misses       1075     1065      -10     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[khvn26]

I am surprised that the new code path is covered by tests and no existing tests are modified, which suggests the backend behaviour is not changed by this PR?

[rolodato]

@khvn26 I don't see any tests for this code, but in any case you can test this by trying to fetch a non-existent SAML configuration. Even if you are using an invalid JWT cookie, this should return 404 when using this fix:

curl -i -X POST http://localhost:8000/api/v1/auth/saml/foo/request/ -d{} --cookie jwt='badtoken'

HTTP/1.1 404 Not Found
Date: Fri, 07 Mar 2025 02:28:52 GMT
Server: WSGIServer/0.2 CPython/3.12.2
Content-Type: application/json
Vary: Accept, Origin
Allow: POST, OPTIONS
Expires: Fri, 07 Mar 2025 02:28:52 GMT
Cache-Control: max-age=0, no-cache, no-store, must-revalidate, private
Pragma: no-cache
X-Frame-Options: DENY
Content-Length: 58
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
Cross-Origin-Opener-Policy: same-origin

{"detail":"No SamlConfiguration matches the given query."}⏎

Before this change, the request fails and prevents users with expired or invalid tokens from logging in via SAML:

HTTP/1.1 401 Unauthorized
Date: Fri, 07 Mar 2025 02:28:23 GMT
Server: WSGIServer/0.2 CPython/3.12.2
Content-Type: application/json
WWW-Authenticate: Cookie realm="api"
Vary: Accept, Origin
Allow: POST, OPTIONS
Expires: Fri, 07 Mar 2025 02:28:23 GMT
Cache-Control: max-age=0, no-cache, no-store, must-revalidate, private
Pragma: no-cache
X-Frame-Options: DENY
Content-Length: 185
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
Cross-Origin-Opener-Policy: same-origin

{"detail":"Given token not valid for any token type","code":"token_not_valid","messages":[{"token_class":"SlidingToken","token_type":"sliding","message":"Token is invalid or expired"}]}⏎