Better detection of "cookies deleted" in the application

Contribute Feature

AI-generated summary

Better detection of “cookies deleted” in the application

A situation occurs when users delete cookies or have junk redis, causing odd behavior. The application appears to think the user is still logged in, but secure topics display only placeholders, and the site returns 302s or 403s.

sam proposes solving this issue by adding custom HTTP headers: DISCOURSE_LOGGED_IN: true to client Ajax calls and DISCOURSE_LOGGED_OUT: true to server responses when there’s a conflict between client and server state. This would enable the client to detect when it’s been logged out and display a modal asking the user to refresh.

fefrei points out a potential duplicate topic on Meta, but is grateful for the attention to this issue. sam implemented the solution, and fefrei expressed their appreciation for the fix.

1

Occasionally users may delete all cookies or in self hosted situations (which do not have auth token set via env) junk redis.

When this happens behaviour is kind of odd.

It looks like you are logged in:

image
image507×244 6.01 KB

If you are browsing a secure topic, you only see placeholders:

image
image1280×497 2.93 KB

Depending on the site you are on (requires login or not) you will start seeing lots of 302s or 403s

Instead:

If we detect a user is somehow no longer logged in, we should open a modal saying “looks like you were logged out would you like to refresh” or something along those lines.

We can solve this very cleanly, by:

  1. Adding a custom HTTP header: DISCOURSE_LOGGED_IN: true to all Ajax calls we make (based on what the client thinks.

  2. Adding a custom HTTP header to responses from the server when there is a conflict between server and client state: DISCOURSE_LOGGED_OUT: true

Then client can easily tell that it was logged out and raise the screen and if anyone anywhere has issues with status codes (due to live permission changes and the like) we will not confuse it with the “logged out” situation.

10 Likes
Discourse Version 2.0
Cannot middle-click or control-click on embedded topics to open in new tab
Internal Server Error after User is logged out by Admin
3

Isn’t this a duplicate and proposed solution to… gasp… my first topic on Meta? :scream:

Thanks for looking into this :sun_with_face:

7 Likes
Errors after missing a logout notification
4

Completed per:

https://github.com/discourse/discourse/commit/0134e41286255111f2644a5b90e03640efef5db1

Pretty bullet proof after this change.

11 Likes
5

Wohoo, wonderful! Thank you :cherry_blossom:

(Sorry to spam you, but a :heart: simply wasn’t enough :wink:)

7 Likes
6

This topic was automatically closed after 25 hours. New replies are no longer allowed.