Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Redirect to login page after session timeout #7981

Closed
sgauruseu opened this issue Mar 28, 2020 · 3 comments
Closed

Redirect to login page after session timeout #7981

sgauruseu opened this issue Mar 28, 2020 · 3 comments

Comments

@sgauruseu
Copy link
Member

sgauruseu commented Mar 28, 2020

Case 1
Set session.timeout = 2 in com.enonic.xp.web.jetty.cfg then restart XP

  1. Login to XP, navigate to Settings, for example
  2. Wait for the session expired.
    Expected: Redirect to login page after session timeout
    Actual - New button is enabled, click on the button - wizard loads
    image

Type a name - Save button is enabled.
Refresh the wizard in browser - Login Page loads

Case 2
The same issue after you stop the server then restart it again.

Actual - Browse panel (previous session) is available, click on New button - New Content dialog loads:

image

@sgauruseu sgauruseu added the Bug label Mar 28, 2020
@rymsha
Copy link
Contributor

rymsha commented Mar 30, 2020

Case 1. Theoretically you need to wait infinite amount of time to get session expired, due to status ping. Need better explanation.

Case 2. Is less valuable as servers don't get restarted often in production often (currently)

Either way fixing this bug would prevent us from correctly implementing #7924 and #7529

@sigdestad
Copy link
Member

Not entirely correct, the session would time out if you are disconnected for a while. However, the idea behavior should be discussed

@rymsha
Copy link
Contributor

rymsha commented Mar 30, 2020

@sgauruseu and I discussed it internally. The correct behavior may depend on an application:
in CS it would be best to show a toast saying that game is over and it is best to copy paste big parts of texts somewhere else and relogin.
in Users app due to its security nature and not so much work to loose - redirect to login is probably a good idea.
Applications app also doesn't do much about connection loose/session expiration, but maybe it is least important one.

Anyway XP can do little to nothing how frontend should proceed connection or permission loss.

So, we agreed that @sgauruseu will file issues for improvements for each application individually.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants