Bug: Unable to preview/view component assets unless logged into CMS

[pomegranited]

The user must be explicitly logged in to the CMS or they get a 403 when trying to view library component assets.

See e.g deer.jpg.

We'll need a solution that works for both the Authoring MFE and the Learning MFE.

Steps to reproduce

1. Log out completely: https://tagging-preview.staging.do.opencraft.hosting/logout
2. Log in to the MFE (via LMS): https://app.tagging-preview.staging.do.opencraft.hosting/course-authoring/home
3. Search for the "Deer" text component in the Testing Library: https://app.tagging-preview.staging.do.opencraft.hosting/course-authoring/library/lib:OpenCraft:TL/components
4. Preview it -- the dear.jpg request will 403
5. Login to the CMS: https://cms.tagging-preview.staging.do.opencraft.hosting/login/
6. Refresh the component -- the dear.jpg request will succeed.

[bradenmacdonald]

@pomegranited How does one get the MFE without being explicitly logged in to the CMS? What are the steps for reproducing this?

[pomegranited]

@bradenmacdonald

How does one get the MFE without being explicitly logged in to the CMS?

Logging into the MFE is done via the LMS, not the CMS, so we're logged in to the LMS, but not necessarily to the CMS. And CMS auth is SSO now.

The API hits that the MFE makes to the CMS are authenticated with JWTs -- which gets around this issue. But when the page just makes a normal request to view a static file, unless we've gone through the full CMS SSO login process, we're not authenticated

What are the steps for reproducing this?

I've updated the issue with the steps.

[navinkarkera]

@jmakowski1123 @lizc577 @sdaitzman @marcotuts This is ready for AC testing on the sandbox

[ChrisChV]

@jmakowski1123 @lizc577 @sdaitzman @marcotuts Friendly reminder that this is ready for AC testing on the sandbox