Avoid showing the Login page if already logged in, and fix redirect loops.

Review Request #13438 — Created Nov. 27, 2023 and submitted

Information

Review Board
release-5.0.x

Reviewers

While working with a customer, I witnessed some confusion where the user
tried to log in, got redirected back to the Log In page, and then
thought they hadn't successfully logged in. This was occurring because
they were navigating to the Log In page, clicking Log In in the
navigation bar, and ending up back to the Log In page with a redirect
URL set back to the same page. Worse, if clicking Log In from the Log
Out page, users would get logged out immediately after logging in.

To avoid these situations, we now redirect away from the Log In page if
the user is already logged in. We only do this after we check for all
the SSO/client-side login flows, so that we don't disrupt those.

If the destination page would be the Log In or Log Out pages, we
normalize it back out to root URL for the server/Local Site. This
avoids these loops, and helpfully ensures users won't get immediately
logged out when logging in.

Django has a mechanism to do these sort of checks, but it doesn't handle
the redirect-to-login case. Actually, it does, but it handles it via
raising an exception. Our approach is more tailored to our needs.

Tested logging in and redirecting.

Tested visiting the page while already logged in, and testing without
a login redirect, with a suitable redirect, and with a redirect loop.

Performed the same test when clicking the Log In link from the Log Out
page.

Unit tests pass.

Summary ID
Avoid showing the Login page if already logged in, and fix redirect loops.
While working with a customer, I witnessed some confusion where the user tried to log in, got redirected back to the Log In page, and then thought they hadn't successfully logged in. This was occurring because they were navigating to the Log In page, clicking Log In in the navigation bar, and ending up back to the Log In page with a redirect URL set back to the same page. Worse, if clicking Log In from the Log Out page, users would get logged out immediately after logging in. To avoid these situations, we now redirect away from the Log In page if the user is already logged in. We only do this after we check for all the SSO/client-side login flows, so that we don't disrupt those. If the destination page would be the Log In or Log Out pages, we normalize it back out to root URL for the server/Local Site. This avoids these loops, and helpfully ensures users won't get immediately logged out when logging in. Django has a mechanism to do these sort of checks, but it doesn't handle the redirect-to-login case. Actually, it does, but it handles it via raising an exception. Our approach is more tailored to our needs.
7f79fb8b9d89b2aecce0d7f13248737aa832073f
david
  1. Ship It!
  2. 
      
maubin
  1. Ship It!
  2. 
      
chipx86
Review request changed

Status: Closed (submitted)

Change Summary:

Pushed to release-5.0.x (f2fd73d)
Loading...