As a user I don't want the client making backend 301 requests for my login on unauthenticated routes

empowerai / fs-permit-platform

Module for intake of special use applications for Forest Service Application Permits

Other

3 stars 0 forks source link

As a user I don't want the client making backend 301 requests for my login on unauthenticated routes #357

Open sadlerw opened 6 years ago

sadlerw commented 6 years ago

Notes

technical issue to prevent unnecessary network traffic caused by the special applications header

Acceptance criteria

[x] no 301 in network panel for unauthenticated routes

Tasks

[x] check route for authentication flag before calling authentication service (will)

Definition of Done

[x] Code unit / e2e tested and comply with QWASP
[x] No new security vulnerabilities
[x] Internal team code review
[x] Documentation / readme.md / CircleCI updated
[x] Docker updated
[x] Compare finished design with mockup
[ ] Usability tested

sadlerw commented 6 years ago

@ASprinkle Could we bring this into the current sprint please? Will be 5-8 points thanks, Will

ASprinkle commented 6 years ago

Yes, at the top of the product back log for the team to pull in.

sadlerw commented 6 years ago

I’m working on potentially hiding the login header on the tree pages except for the admin page as part of this story. I think that it will be less confusing to users since they won’t want to go try and login on login.gov then if it isn’t in the header.

so that’s question 1 - is that ok?

question 2 is “if a user IS logged in should we display their name and the logout link in the header on the trees pages (except for the report/admin page)?” I think yes, because you are logged in. The only issue is that when you logout it takes you to / no matter where you are and displays a message “You have successfully logged out of Forest service epermits” which I think should be changed to "You have successfully logged out."

The other option would be to try and route the user back to a different page depending on where they are when they click logout.

bryanmcfadden commented 6 years ago

In regards to will's first question above...the 'log in' link in the header has been an issue with users in the past usability tests. Most people assume an account is needed before they can purchase a Christmas tree.

You can see it here in sprint 05 (at the bottom)

ASprinkle commented 6 years ago

I think we've already addressed all of Wills questions - just want to make sure I follow up. Question 1 Yes - hide login for public users (non FS) Question 2 - show logout for FS Admins who are logged in.

sadlerw commented 6 years ago

this is on staging now - I just need @sethalt to check all of the non-tree permit stuff to verify nothing has broken