3233: Handle session expired in Admin Panel #2906
Conversation
chris-bes
force-pushed
the
3233-session-expires-handle
branch
from
27605a7 to
1a92ffc
Compare
| @@ -11,7 +11,7 @@ export const attachSession = async (req: Request, res: Response, next: NextFunct | |||
| try { | |||
| const sessionId = req.sessionCookie?.id; | |||
| if (!sessionId) { | |||
| throw new UnauthenticatedError('User not authenticated'); | |||
| throw new UnauthenticatedError('Session not found or has expired. Please log in again.'); | |||
There was a problem hiding this comment.
Tom suggested a nice idea to which is to use a new http response code to indicate that the session has expired (beyondessential/tupaia-backlog#3233 (comment)). However, I think with the case of session cookie not found, it could be because of some other reasons rather than just the session has expired (eg: someone unauthenticated trying to access the server). So I'm still keeping 401 as the response code here.
| @@ -77,9 +79,21 @@ export class TupaiaApi { | |||
| }; | |||
| } | |||
|
|
|||
| async checkIfAuthorized(response) { | |||
| // Unauthorized | |||
| if (response.status === 401) { | |||
There was a problem hiding this comment.
Initially I was wondering whether it is too aggressive to always log out users when there is a 401 but after thinking about it for a while I agree that it makes good sense.
Yep, PSSS already logs people out when response code is 401. However, now that you mentioned, I've realized the error message if that happens is still |
merge latest dev into branch for testing
Issue:
https://github.com/beyondessential/tupaia-backlog/issues/3233
https://linear.app/tupaia/issue/MEL-373/
Changes: