| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0010543 | Taler | libeufin-bank webui | public | 2025-10-31 12:51 | 2025-11-22 22:06 |
| Reporter | avalos | Assigned To | sebasjm | Resolution deadline | |
| Implementer | Reviewer | ||||
| Release signed by | Deployed by | ||||
| Verifier | Communicator | ||||
| Data protection authority notification required | No | ||||
| CSIRT notification required | No | ||||
| Estimated effort (hours) | Actual effort (hours) | 0 | |||
| Fast-track | No | ||||
| Work package | none | ||||
| Priority | normal | Severity | minor | Reproducibility | have not tried |
| Status | closed | Resolution | fixed | ||
| Product Version | git (master) | ||||
| Target Version | 1.2 | Fixed in Version | 1.2 | ||
| Summary | 0010543: expired session makes confirming withdrawal impossible | ||||
| Description | Something is going awry with expired sessions. | ||||
| Steps To Reproduce | 1. Go to https://bank.demo.taler.net/ (with an expired session) 2. A login form with the username pre-filled and a "Check" button will appear, but don't login because you forgot the password, instead... 3. Create a new account and... 4. Login with the new account. 5. Do a withdrawal to the wallet. 6. Open the link in the wallet and confirm. 7. In the SPA, instead of a confirmation button, a login form with a warning "This operation was created with another username", the previous username pre-filled, and a "Check" button will appear. 8. Enter a password or click "Cancel," and it will take you back to the login screen. 9. Rinse and repeat (from step 4) | ||||
| Tags | No tags attached. | ||||
| -> check how we are covering the case when the expired session is not the same as the original withdrawal maybe handing the case saying "login with this username to complete the operation" | |
| No, no, it's as simple as, if you login with a different account and do a withdrawal, don't ask me to confirm some withdrawal that was made with the expired account. | |
| fb5a6ea28..13facb53b two things where fixed: 1) hitting enter on an input triggered "cancel" instead of "check" which caused the confusion in 'username pre-filled, and a "Check" button will appear' 2) the login form don't mention that this browser has an expired session > don't ask me to confirm some withdrawal that was made with the expired account. when you click the link on the wallet you are opening a browser that doesn't have the session used to create the withdrawal. in your case it has a expired session so it needs to ask the passwd again since the access token doesn't work anymore. image-3.png (16,522 bytes) image-4.png (35,045 bytes) | |