search

medic / cht-user-management

GNU Affero General Public License v3.0
3 stars 1 forks source link

User blocked from downloading credentials due to cookie expiration #53

Open kennsippell opened 5 months ago

kennsippell commented 5 months ago
  1. User initiates a large upload
  2. Waits a long time (hours) for upload to complete
  3. Attempts to download credentials

Expected: Resulting credentials Observed: Login page

This is because cookies expire after 1 day.

mrjones-plip commented 5 months ago

Poking around a bit, I see we set the session cookie only once at login. I think there's a holistic fix for the UX of "my session timed out and I didn't know it" which covers failed download of credentials in this ticket. Suggestion woudl be to renew the cookie to expire LOGIN_EXPIRES_AFTER_MS from time of current page load. This way session expires LOGIN_EXPIRES_AFTER_MS after they last used the app instead of LOGIN_EXPIRES_AFTER_MS after they logged in.

Additionally, we could extend the app do some sort of setInterval() call where if the session cookie is expired the user forcefully is redirected to a login page. This covers the UX of being logged in, attempting to use the page rendered when logged in, but every AJAX request returns the HTML of a login page.

billwambua commented 5 months ago

Also the suggestion to auto download credentials on upload completion by @mrjones-plip is good.