search

BookStackApp / BookStack

A platform to create documentation/wiki content built with PHP & Laravel
https://www.bookstackapp.com/
MIT License
15.47k stars 1.94k forks source link

Redirect to Login Page on Session Expiration #1975

Open EHLO1 opened 4 years ago

EHLO1 commented 4 years ago

Describe the bug Might not be a bug! If it's not, we can make this a feature request?

I have the following configured in the .env: SESSION_LIFETIME=120 SESSION_COOKIE_NAME=bookstack_session SESSION_SECURE_COOKIE=true

Those settings work great, however, when a user's session expires, nothing happens. As an example, a user is writing a page, locks their computer and leaves for the day, then returns the next day to the same screen. They continue typing, but the moment they hit save or navigate anywhere else, THEN they get returned to the login page.

Steps To Reproduce Steps to reproduce the behavior:

  1. Configure the session settings in .env
  2. Login and wait for the session to expire.
  3. Notice that nothing has changed.
  4. Try to navigate anywhere and then get returned to the login page.

Expected behavior When a user's session expires, they should be returned to the login page.

Your Configuration (please complete the following information):

If this issue should be taken up with Linuxserver.io, I will post it there instead. Thanks for any assistance you can provide!

dopyrory3 commented 4 years ago

+1 I've deployed Bookstack in my organisation, really would be good to either notify users of session expiration or redirect to the login page. The current method of handling it by not handling it is frustrating for a lot of people in my experience using this project

EHLO1 commented 4 years ago

I did a bit of reading on Laravel. Doesn't look like it's quite as straight forward as I thought. Apparently there are complications with multiple tabs being open.

An alternative could be to use JS to check last user activity and then post some sort of pop-up message after a period of inactivity letting them know they need to login again, and that they should save (or copy) their data. Is something like this more plausible?