User tests: Successful: Unsuccessful:
Pull Request for Issue # #32895
After attempting to login with invalid credentials, you are not redirected back to the login page, so pressing refresh actually attempts to send the POST request a second time.
Administrator login form doesn't follow Post/Redirect/Get pattern
(also a quick typo fix in comment)
Attempt to login to Joomla 4 with invalid credentials.
Inspect the requests/responses with browser inspector tools
Request: POST of invalid credentials
Response: HTML with error message, if you refresh the page the browser asks to resend the form
Request: POST of invalid credentials
Response: 303 Other redirect to /administrator/index.php
browser follows redirect (not always shown in the inspector on some browsers, look hard, it fooled me too)
Response: GET /administrator/index.php, if you refresh the page the browser just performs a refresh (GET) and validation message is missing as its already displayed
none
Status | New | ⇒ | Pending |
Category | ⇒ | Administration com_login |
Labels |
Added:
?
|
I have tested this item
I used the Firefox live headers and selected a un/pw not for my test site - surprised to see the pw in plain text in the record! A sobering lesson!
Status | Pending | ⇒ | Ready to Commit |
RTC
Status | Ready to Commit | ⇒ | Fixed in Code Base |
Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2021-03-30 07:43:02 |
Closed_By | ⇒ | rdeutz | |
Labels |
Added:
?
|
I have tested this item✅ successfully on 5fe0333
Tested successfully in Beta8-dev updated to 29 March in Windows 10 running Wampserver 3.2.4 and PHP 8.0.2.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/32897.