Page reloads (expected cookie issue)

Description

Environment

See comprehensive test done by :

The bug is possible to reproduce in Firefox and Safari in test and stage (awating access to prod). As both browsers seems to have more strict privacy settings by default than Edge and Chrome, that might be something to look into.

See attached console and network log for further details

Error

If you don’t use the internal website for 4-5 minutes and you return to continue your work, OS2valghalla stops responding and the UI seems to be updating something. Suddenly a very quick error message is shown:
HTTP failure response for https://holbaek-adm.os2valghalla.dk/api/auth/ state: 0 Unknown Error

Then “redirect=true” are added to the URL, the page reloads and things are back to normal. However if you had entered anything in the frontend it has disappeared.

I was not expecting any of this to happen. If my session is finished I expected to be logged out but not until 30-60 minutes of inactivity.

Steps to reproduce

Video of experience (first 16 seconds):  

  1. Go to Communication logs: https://holbaek-adm.os2valghalla.dk/communication/communication-logs

  2. Wait 4-5 minutes

  3. Click on Participants menu item: https://holbaek-adm.os2valghalla.dk/participant

  4. See that entries in table seems to be loading

  5. Wait for error message to quickly show

  6. See page reload

 

Browsers: Firefox (latest version, MacOS) + Edge (Win10)

Acceptance criteria

None

How to test

None

Attachments

8

Activity

Show:

Mogens Kjeldsen 3 April 2024 at 11:19

It is no longer possible to reproduce the bug across Firefox, Chrome, Edge and Safari. My test have not shown any other problems in internal or external web. Actually the system seems much faster now. Good work

Mogens Kjeldsen 14 March 2024 at 14:05

Like agreed upon on today's meeting we will go for the long term solution.

Dan Nobel 14 March 2024 at 07:47

I can reproduce the page reload issue in a fresh installation of Firefox.

None of the configuration settings tried have yielded a consistent change for the experience.
We are out of smaller adjustments to try

There is a different experience in different browsers for different users and it seems to be related to which is handled differently in the different browsers

  • Copenhagen report it works in Chrome, but reloads page in Edge, with no changes to exceptions settings. (short term solution explained below)

  • Anne-Marie reports it reloads in Edge and Chrome, but if she configure them to use the exceptions settings, then works as it should.

  • Jesper experience reload all the time in Chrome, Edge and Opera no matter if the exceptions settings are there or not.

  • Mogens has the issue in Firefox but not in Edge or Chrome, no exception settings.

  • I have noticed different behaviors at different time.

    • FireFox reloads, except if I configure the trust settings, then it works as expected.

    • Edge works on my machine, it reloads on the management server (jump server) in the hosting environment

    • Chrome works

    • Opera works

I've looked into a short term solution and discussed a more long term solution with

Short term solution could be to add the Valghalla site and access control site to cookie exceptions in the browser, ex. for FireFox as in the screenshot below.

for staging it would be test-korsbaek-adm.os2valghalla.dk and adgangsstyring.eksterntest-stoettesystemerne.dk
for prod <municipal-adm>.os2valghalla.dk and adgangsstyring.stoettesystemerne.dk

This setting could make it a more fluent experience because it will allow the refresh of cookies to run without page load.

A long term solution should could be to do major adjustments to the login process so it will use JWT against the frontend instead and SAML in the backend.
Core functionality wise there should be no difference, but it should eliminate the page reload issue and the third party cookie handling issue at the same time.
will investigate and give an estimate on the work needed.

as I see it with the investigations I’ve done and the feed back from municipal I don’t see another way around than to deal with this sooner than later, but please let me know if you disagree

Dan Nobel 14 March 2024 at 07:34

I have not, I can ask them, but I expect more or less the same answer as when we started, they will point to the documentation (.NET classic) and politely ask us to figure it out on own.
But I can surely ask them again.

Mogens Kjeldsen 13 March 2024 at 11:58

Just a thought - did you try asking KOMBIT at some point what kind of solution they recommend for this problem? Should we look for other systems using FK Adgangsstyring and their solution?

Fixed

Details

Assignee

Reporter

Priority

Created 20 February 2024 at 13:00
Updated 15 April 2024 at 12:04
Resolved 4 April 2024 at 13:55