Open fungc-io opened 8 months ago
Are we going to change the message only? Another concern is that the back to login button does not work for native apps. I think we need discussion on how we are going to fix this problem.
We decide to separate the error case and the real direct access case:
The real direct access case will be handled in DEV-1442 : Endpoint Direct Access behaviour
In this issue, we shall focus on improving the error when the session is invalid, and reduce the chance of it happening.
Problem
It's easy to trigger the "Direct Access disallowed" in the web apps for example, user quit and reopen the mobile browser. They will see a cryptic message
Proposed change
Please also research if giving up session cookie is ok security-wise