If it has been a while since visiting that link the user will get “Account login timed out, please try logging in again.” If I visit the exact link again, the user is successfully logged in and I do not receive the error message. My question is: if the account login is timed out, why doesn’t the discourse system go ahead and call my external sso url like it does the second time? It’s as if, first, the user has to attempt going to a url in discourse and get the error message. Discourse notices and saves some setting. The second time, discourse knows the user is logged out and correctly calls the sso flow. Why can’t it immediately call the sso flow and skip the “Account login timed out” error? In fact, it seems in previous versions of Discourse I did not have this problem.
I was running multiple containers taking SSO requests. I was retaining a bit of state between requests and if a single user jumped between containers, I lost the state I needed and received the error. Temporarily I scaled down to one container.
I’ve just add discourse forum to my web site and enable sso-login. Users have this error on every new login try while login takes 5-10 seconds not 10 min. After clicking my logo or reload the page user is logged in. Please advice how to solve this problem. It’s bad UX and confusing for users
I’ve fixed it. The problem was the next:
My client is react app and the redirect to forum with payload to log in is located in componentDidUpdate lifecycle method of some high-order component. For every login attempt this redirect was fired twice - so first one was successful, while the second one with the same nonce got error because nonce was already expired after the first one. As a result user actually was logged in but saw the error “Account login timed out, please try logging in again”
