Bug 1092790 - Expired sessions have poor usability
Summary: Expired sessions have poor usability
Keywords:
Status: CLOSED UPSTREAM
Alias: None
Product: Zanata
Classification: Retired
Component: Security
Version: development
Hardware: Unspecified
OS: Unspecified
high
medium
Target Milestone: ---
: ---
Assignee: David Mason
QA Contact: Zanata-QA Mailling List
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-04-30 02:40 UTC by David Mason
Modified: 2015-07-31 01:46 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: 5
Clone Of:
Environment:
Last Closed: 2015-07-31 01:46:57 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 958194 0 high CLOSED RFE: Implement a "remember me" functionality 2021-02-22 00:41:40 UTC

Internal Links: 958194

Description David Mason 2014-04-30 02:40:44 UTC
Description of problem:

- when a user tries to perform an operation when their session has timed out on the server, they are redirected to the error page, then when they log in they are redirected back to the error page with a "no errors" message.
- if a user is editing a project homepage and other field that may hold a significant amount of data, if the user presses 'save' after their session has expired, they are redirected to the error page and lose the data they had entered in the field.

How reproducible:
Always after session timeout

Expected results:
 - Attempting an operation after session timeout should cause users to be presented with a login form.
 - Signing in after session timeout should return users to the page they were previously on.
 - Users have an opportunity to save or recover entered data after they have attempted to perform an operation after session timeout.


Approaches considered:

 1. modal login dialog when you try to do something that requires login (AJAX)
 2. when trying to do an operation after session timeout, redirect to login, and make sure user is returned to the page they were on when they tried to do the operation (would potentially lose data you are in the middle of entering).
 3. save data in a temporary place on the server, save it after login.
 4. use localStorage to save text fields etc. when an operation fails due to session timeout. Offer to recover the data the next time they go to the page (discard the data when they use it or discard it).

Option 2 is considered most feasible.
Option 4 should be prototyped to gain an idea of its feasibility.

Comment 1 Damian Jansen 2014-07-28 01:54:44 UTC
The user being kicked out of a webtrans session while editing is the most unpleasant of all these - this should be fixed (with the temp save or otherwise).

The other part is finding all the places/actions that require a logged in user and testing what happens when the session is invalidated.

Comment 2 Zanata Migrator 2015-07-31 01:46:57 UTC
Migrated; check JIRA for bug status: http://zanata.atlassian.net/browse/ZNTA-537


Note You need to log in before you can comment on or make changes to this bug.