fix: return 401 instead of 500 for AJAX requests with expired session

[f2cmb]

• It fixes Requests to /ajax/notifications_ajax.php return a 500 error when session is expired #21557
• Here is a brief description of what this PR does :

Fix AJAX requests returning HTTP 500 instead of 401 when session expires.

The AccessErrorListener had an early return for AJAX requests that prevented handling of SessionExpiredException. This has been fixed by processing SessionExpiredException before the
AJAX check.

For AJAX requests with expired sessions, the listener now returns a proper JSON 401 response:

  {
    "error": "Your session has expired",
    "message": "Please log in again",
    "code": "ERROR_SESSION_EXPIRED"
  }

HTML requests continue to redirect to the login page as before. Other exception handling remains unchanged.

Warning : This fix applies to all 122 AJAX endpoints in the application. Low risk of impact, though frontend handling of 401 responses should be monitored after deployment.

[f2cmb]

No tests added for the moment as i am not sure about potential impact : need pre-review first.

[trasher]

I'm not confident enough with new routiong system, I'll wait for @cedric-anne review.

[cedric-anne]

Throwing back a HttpException should permit to have it correctly handled by the ErrorController.

Suggested change

	// For AJAX/JSON requests, return a JSON response with 401 status
	$response = new JsonResponse([
	'error' => __('Your session has expired'),
	'message' => __('Please log in again'),
	'code' => 'ERROR_SESSION_EXPIRED',
	], 401);
	// For AJAX/JSON requests, convert the error into a HttpException
	$http_exception = new \Glpi\Exception\Http\HttpException(403, 'Session expired.');
	$http_exception->setMessageToDisplay(__('Your session has expired. Please log in again.'));
	throw $http_exception;

[f2cmb]

Response code shouldn't be 401 instead of 403 ? https://stackoverflow.com/questions/1653493/what-http-status-code-is-supposed-to-be-used-to-tell-the-client-the-session-has

[f2cmb]

Changed here 2d6d33b but i kept 401 Response Code.

[trasher]

Seems like the $event->setResponse($response); is wrongly conditionned

[trasher]

Seems like the $event->setResponse($response); is wrongly conditionned

Nevermind, it's OK