search

standardnotes / syncing-server

[Deprecated: Use our new Node server: https://github.com/standardnotes/syncing-server-js]
https://standardnotes.org
GNU Affero General Public License v3.0
209 stars 48 forks source link

constantly needing to re-login #149

Closed clarity99 closed 3 years ago

clarity99 commented 3 years ago

Hi,

I'm having some issues with using the app and I'm not sure if this is by design or a bug. I am using the self-hosted setup with the docker syncing server. Basically, the app needs me to relogin quite a lot - it seems like at least every time the computer comes out of sleep I need to reenter both the email and the password. So, first gripe - why do I have to reenter both - email and password? The text says please reenter credentials for xxx@xyz.com, so the email at least is saved, but I then have to reenter it. Second grip is about the amount of relogins that are needed. I've browsed the issues and it seems years ago people had the opposite problem, that the app asked too rarely for the password, so not sure what changed. Not sure what the threat model is here? If I'm logged in my account I'm assuming this as secure enough, and for extra sensitive data one can lock notes themselves?

I tried enabling the passcode, thinking that perhaps with passcode the credentials will be saved, but then the flow is even worse. It asks for my passcode, then the relogin prompt comes up and after that I need to reenter the passcode again! This is a no-go in terms of usability for me. Am I doing something wrong, or missing something?

Thanks!

JaspalSuri commented 3 years ago

Hi @clarity99,

I'm sorry to hear that. It looks like a couple of other users were affected by this issue. Can you take a look at this thread and let us know if it helps?

clarity99 commented 3 years ago

thank you, changing environment to production seems to work! The UX question still stands though - if you say please reenter credentials for xx@xx.com, why do I then have to enter xx@xx.com again?

moughxyz commented 3 years ago

It's simply because our Challenge API doesn't allow pre-filled values in the input boxes yet ;) The re-authenticate form is built using the Challenge API and is non-specific. But we'll get this in eventually for a simpler UX.

clarity99 commented 3 years ago

ah, thanks, I'll close this issue then.