search

thingco / shared-frontend-libs

0 stars 0 forks source link

[FEAT] - Handle session timeouts better #85

Open ThingCoDanW opened 2 years ago

ThingCoDanW commented 2 years ago

Which package is this related to?

Is your feature request related to a problem? Please describe. Currently the app will log out a user after ~24 hours when using password login. This results in the user being sent back to the login screen. Upon logging back in, the pin will already be set from the previous session, and the user will be asked to enter this pin. This is a problem for two reasons:

  1. If a different user logs in, they will be presented with a pin they did not set.
  2. After logging in with password, a second stage of verification (pin) is not necessary

Describe the solution you'd like We have a few options here, depending on how we want to handle this.

  1. Clear the pin when a user session expires. This is the quickest/easiest, but IMO the least user friendly. On short sessions (like 24 hours) it makes the pin feel like a waste of time; Why are we bothering to make the user set one at all, only to wipe it 24 hours later?
  2. Remember the user's username and prompt for only a password. I think this is the best solution, we're not asking the user to re-enter information which we already have stored and it's less work overall for the user which makes the process less frustrating. If the user has changed, they will need to cancel and return to full login, at which point we trigger a logout and wipe the previous user's data (including pin) from the device.
  3. Skip pin entry after login. If a pin is already set, we don't need to prompt the user to enter it immediately after they sign in. This should be done in combination with 2

Describe alternatives you've considered Ignore the problem and annoy the user :)