Unable to login first time after session expires

[alex.kolaric]

Hi,

Is there any reason why after session has expired first attempt to log in always fails. I was checking example 43 and it has the same behavior. I found that the reason for this is that GetSessionValue('hash') is blank when I hit login button after session has expired so

GetValue('hash') <> GetSessionValue('hash')

checking always fails.

Any workaround?

cheers,
Alex

[Mike Grigsby]

I thought it was just me. To add to this, it's not all the time. It's like if you've logged out and sitting at the log in page, and try to log in again, it doesn't take it the first time. But it seems like waiting after the session has expired, it will let you log in again. This has been happening from several pre-releases ago, but I thought it was something I was doing with the net:s:SID value.

[alex.kolaric]

I'm getting this behaviour all the time. Doesn't matter for how long I wait. I can probably come up with some tweak to work around it but I'm afraid I could break something else.

[Bruce]

Hi Alex,

I can't seem to duplicate your effect, using example 43 in either FF or IE.
Can you give me specific steps to follow?

Cheers
Bruce

[alex.kolaric]

Hi Bruce,

here are the steps:

1) I modify time out value within app to 00:01 so my session times out after 1 min. I'm busy man you know so I can't wait 
2) Recompile, start and access it through the browser (IE6 & IE 7)
3) On the login screen I log as Guest/Guest. Everything is ok
4) Start Browse->Mailboxes. Everything is ok
5) Wait for more than one minute.
6) Start Browse->Aliases and I get login screen. Everything is ok
7) Try to login again as Guest/Guest and I get "Login Failed. Try Again" message
If I click on the login button once again it logs ok

Again, I'm pointing out that I get blank for GetSessionValue('hash') when error occurs. Weird, huh?

hope this helps,
Alex

[alex.kolaric]

Hi Bruce,

Any luck with reproducing my problem?

cheers,
Alex

[Bruce]

Hi Alex,

nope, it all seems to work for me - but I'm trying variations to see what might be different between yours and mine.

Cheers
Bruce

[alex.kolaric]

Hi Bruce,

is there any workaround or code modification realted to this hash checking which can be used to bypass this problem I'm having? What is the significance of this hash value anyway?

thanks,
Alex

[Bruce]

Hi Alex,

Some examples use the hash value - some don't.
It's an additional security mechanism, as I recall, to stop the user pressing the "back" button to re-login.
You can probably remove it if you like.

I'm still having no joy duplicating the effect here.

Cheers
Bruce

[alex.kolaric]

Thanks Bruce,

I will have to remove it for now since it doesn't work every time and creates confusion why login doesn't work. Please inform me if you find something. I know you are dealing with much more serious things for 4.31 but please don't forget me 

cheers,
Alex