A discussion was started by jomaxro about a bug where a suspended user’s “last seen” time is updated when they attempt to log in via social logins (e.g., Google, Facebook) despite being denied access. cpradio pointed out that this issue might also occur with Single Sign-On (SSO). Mittineague and TechnoBear investigated the issue and found it to be related to the login process, specifically when a suspended member attempts to log in to the forums, but not when logging into their Premium account.
The issue was reported to have been fixed for SSO, but jomaxro was unsure if it was still a problem. eviltrout confirmed that they did not change it for SSO, and it’s possible another change might have fixed it.
After further testing, jomaxro found that the issue was still present with Facebook login, but not Google login. sam requested david to review the login flow and correct the issue. david subsequently added a test case and fixed the issue, which is now available in the Discourse GitHub repository: https://github.com/discourse/discourse/commit/2dc3a50dacb2aa699b0c68c9abf8fcc5436dc81b
A suspended user cannot login to the Discourse site. If a user attempts to login to a site with their username and password, they’re denied access. The user’s “last seen” time is not modified.
However, if a suspended user attempts to log in with a social login (Google, Facebook, etc.), the “last seen” time is bumped to the current time, despite the user being denied access. This is inconsistent and would be nice to fix.
I believe this happens with SSO too. @TechnoBear and @Mittineague can you confirm this is what you were looking into?
That’s what I had noticed. IIRC, we concluded that it was most likely peculiar to SitePoint Premium handling the login process and not a core Discourse issue.
That is, if a member had been suspended in the forum, they should still be able to access their Premium account, and when they logged in to Premium the event was sent to the forum anyway.
My guess is that the login modal (screen in SitePoints case) was updating the last seen at the beginning of the log in process instead of on its success. But I haven’t looked at the code involved yet so I don’t really know.
That’s not quite what was happening. Any member - suspended or otherwise - can log into their Premium account, and it doesn’t register on the forum “last seen” time; only an actual log-in or attempted log-in at the forums does that.
A suspended account making a log-in attempt at the forums will register an updated “last seen” time and a new “Last IP address” (if different), even though they never reached the forums.
We also established that suspended members were unable to log in, but were not shown any message stating their account was suspended. We have no way of testing whether this is simply a problem with our own set-up, or a wider issue with SSO.
I’m fairly certain this was fixed for SSO. Perhaps @eviltrout can clarify?
Thank you.
We’re still on an older version of Discourse, so perhaps an upgrade will fix that particular issue.
I did not change it for SSO, although it’s possible another change did fix it? Someone would have to confirm it is working.
Is this still a problem or can this be closed?
I can no longer reproduce this with Google login, but Facebook login when suspended does still bump the “last seen” time.
Oh, @david since you are all over this login flow can you review this use case and correct it?
Added test case and fixed:
https://github.com/discourse/discourse/commit/2dc3a50dacb2aa699b0c68c9abf8fcc5436dc81b
This topic was automatically closed after 25 hours. New replies are no longer allowed.