Open
Description
During QA for SecureDrop 1.3.0, @emkll reported the following session handling behavior:
There's an edge case, though not sure it's worth addressing:
- Click "Get Started" or hit /generate in both tabs A and B
- Click "Submit Documents" in tab A and logout
- Click "Submit Documents" in tab B, get immediately redirected to "You were logged out due to inactivity".
This behavior is new to 1.3.0, as prior to #5075, you would get an error on step 1.
For reference, the "Submit Documents" button is displayed on this screen:
Questions:
- Would it be preferable to let the user proceed to the submit screen? The downside is that it may result in the confusing generation of a second codename. On the other hand, that may be what the user wanted to do.
- If we do bounce the user back to the index page, should we clarify the error message and explain what happened (something to the effect: you logged out in another tab, try logging in again with your codename?)