[6.x] Fix session-expiry modals being dismissible and silently re-extending sessions - #15020
Merged
Conversation
Fetching a fresh CSRF token for the session-expiry login form touched the session's last_activity, resetting the idle timer and making an expired session look active again. Excludes the token route from extending the session, the same way the session-timeout polling route already was. Fixes #12484
The warning and resume-session modals could be closed by clicking the overlay or pressing Esc (the resume-session and two-factor modals had a typo, :dismissable instead of :dismissible, so it was never actually applied), leaving no clear way to get back to them. Both modals now require an explicit Cancel action to close. Cancelling either one shows a banner explaining the session is expiring/expired, which reopens the relevant modal when clicked.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #12484.
Two related problems with the CP's session-expiry flow:
The session-expiry and resume-session modals could be dismissed by accident. Both the resume-session and two-factor modals were passed
:dismissable="false"instead of the correct:dismissible="false", so the typo'd prop did nothing and clicking the overlay or pressing Esc would silently close them, leaving no way to bring them back. Both now require an explicit Cancel action, which shows a banner that reopens the relevant modal when clicked.An expired session could silently renew itself. When the countdown hit zero,
SessionExpiry.vuefetched a fresh CSRF token before showing the resume-session login form. That request went through the CP's session middleware like any other, which toucheslast_activityand resets the idle timer — so the very act of preparing the "please log back in" prompt re-extended the session it was about to warn about. The next poll would then report a nearly-full session, and the modal would vanish without the user ever re-authenticating.StartSessionalready excluded thesession-timeoutpolling route from extending the session; this excludes the CSRF token route the same way.