search

cul-2016 / quiz

11 stars 4 forks source link

Investigate cookie-related issues #712

Open stianr opened 5 years ago

stianr commented 5 years ago

Over the past year we have had a growing number of reports in which users get stuck in the app, on a loading screen, blank screen, or in the login process, and the only way to be able to log in again seems to be to delete the cookies set by Quodl (examples include #655 #619). We also have reports of more major failures when running quizzes (#705), and issues where the app gives a 404 error when trying to load a - legitimate - page. It may be coincidence, but lecturers have reported that students have been encountering more problems logging in and taking part in the quiz over the past couple of weeks, and I have had problems myself (whitescreen when loading that app page) twice in recent weeks. It's still pretty rare - the vast majority of students don't have a problem - but we want to eliminate it completely if possible.

As a priority we should review how we handle cookies and sessions: (a) to minimise these occurences, and (b) to create a failsafe pathway for users so that at worst they have to log in again - we don't ever want them to be in a position where they have to delete cookies in order to be able to access the app.

stianr commented 5 years ago

A student reported that last week she was unable to log in - entering details on the login page just redirected her back to the same page with login fields cleared. This is exactly the same issue as I encountered here: https://github.com/cul-2016/quiz/issues/655#issuecomment-438392470.

stianr commented 5 years ago

Areas for investigation for probably should be focused on looking at how errors can arise from the way sessions and cookies are currently handled:

  1. How multiple concurrent logins either on different browsers/devices (most important) or tabs in a single browser (less important) are handled - it's fine to log one of the sessions out, but just needs to be orderly so that the active session is not then compromised.
  2. Look at handling errors around sessions and cookies, so that we never have a situation where a user has to go in and manually delete their quodl cookies in order to be able to access the app. It's a balance between convenience (letting users stay logged in long term, so they don't have to login each time they visit the app site) and functionality (making sure sessions work the way they should and users always have access to the app). It might be that we have to require login each time the user visits quodl, and only set a session cookie. That would be safest, I imagine.
stianr commented 5 years ago

Hi @Danwhy, just wanted to check if this was deployed to the main version of Quodl. It looks like it is, but wanted to be sure.