Session expired

Development

AI-generated summary

Celso_Teixeira reports two session expiration issues affecting users of a Discourse forum protected by Cloudflare and integrated with Microsoft SSO via OpenID Connect. First, when the Discourse _t cookie expires, users land on an error page (domain_url/exception). Second, when the Cloudflare cf-authorization cookie expires, users also see the same error page. Both cases prevent seamless access, requiring manual intervention. The goal is to automatically reload the forum upon such errors so users are either redirected to Microsoft login or have their SSO session refreshed transparently. A basic script using window.addEventListener('error', ...) was attempted but results in a jarring experience — users briefly see the error page before reload. Celso_Teixeira seeks smoother, more elegant solutions or improvements to enhance user experience. Screenshots of both error states are included for reference. This issue is a continuation of a prior thread on Cloudflare’s cf-authorization cookie: cloudflare-cookie-cf-authorization.

1

Continued from: Cloudflare cookie: CF_Authorization

We are utilizing Microsoft SSO for login, integrated with OpenID Connect. When users click the forum link, they are redirected to the Microsoft login system, thus no login button is displayed on the forum.

We also use Cloudflare on top of the forum, which includes cookie sessions.

We encounter two issues:

  1. Wen the Discourse _t cookie session expires, users are redirected to an error page.

    Screenshot from 2024-07-17 16-39-54
    Screenshot from 2024-07-17 16-39-54758×482 14.7 KB

  2. When the Cloudflare authorization cookie session expires, users are redirected to an error page.

    Screenshot from 2024-07-11 10-16-51
    Screenshot from 2024-07-11 10-16-51652×359 8.32 KB

Both scenarios redirect users to domain_url/exception.

My goal is to automatically reload the forum when these situations occur. This would ensure users are either redirected to the Microsoft login or the cookies are updated based on SSO.

If anyone has alternative solutions, please share.

I tried the following script:

<script>
window.addEventListener('error', function (event) {
     window.open(url, '_self');
}, true);
</script>

While it works, it is not smooth as the user can see the error page and it takes a while to reload the page.

Please share any other ideas or improvements for a more seamless user experience.

1 Like