Problem/Motivation

The JS always make requests to the routes even if user is not logged. This results in several requests returning 403 and being unneeded.

Proposed resolution

function autologout_attach_js(array &$element, array $settings) {
  if (\Drupal::currentUser()->isAuthenticated()){
    $element['#attached']['drupalSettings']['autologout'] = $settings;
    $element['#attached']['library'][] = 'autologout/drupal.autologout';
    $element['#cache']['tags'][] = 'config:autologout.settings';
  }
}
CommentFileSizeAuthor
#15 autologout-anonymous-user.png23.03 KBinregards2pluto
#15 autologout-authenticated-user.png31.23 KBinregards2pluto
#11 Screenshot from 2025-04-02 17-03-13.png89.66 KButtam
#11 Screenshot from 2025-04-02 17-03-29.png95.83 KButtam
#8 authenticated_user.png45.68 KBanish.ir
#8 anonymous_users.png174.89 KBanish.ir

Issue fork autologout-3498529

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

emanuelcoelho created an issue. See original summary.

sandip’s picture

sandip commented
Assigned: Unassigned » sandip

Working on it.

sandip’s picture

sandip commented

Hi @emanuelcoelho,
I think we can check the authenticated user condition in function autologout_page_attachments_alter(array &$attachments) from where function autologout_attach_js(array &$element, array $settings) is called.
If you agree i will start working on it.

emanuelcoelho’s picture

emanuelcoelho commented

Hi sandip,
Yes if possible.

sandip poddar opened merge request !73

sandip’s picture

sandip commented
Assigned: sandip » Unassigned
Status: Active » Needs review

Please review the MR

emanuelcoelho’s picture

emanuelcoelho commented

Everything looks perfect.
For me it's a go.

Thank you for the quick response.

anish.ir’s picture

anish.ir commented
StatusFileSize
new anonymous_users.png174.89 KB
new authenticated_user.png45.68 KB

Hey @emanuelcoelho,

I have tried reproducing your issue but the libraries mentioned above are not being attached for anonymous users and is only being attached for authenticated users. So, I don't think we will need any validation here. I think the validation is already present for anonymous users.

// If user is anonymous.
  if ($user->id() == 0) {
    return TRUE;
  }

The above validation present in the autologout_autologout_prevent() method is validating for anonymous users.

Please provide detailed steps to replicate the issue, if I am missing something here.

I am using Drupal 11 and 2.x-dev version of the Module here. I am attaching screenshots for the reference.
Thanks !

anish.ir’s picture

anish.ir commented
Status: Needs review » Active
uttam’s picture

uttam commented
Status: Active » Needs review

I have tested the module, and I observed that the autologout.js file is not loading for anonymous users but is correctly loading for authenticated users. This behavior occurs without applying the proposed patch.

Since the reported issue was about autologout.js making unnecessary requests for anonymous users, but that is not happening in the 2.x-dev version, this might already be resolved.

Can anyone confirm if this issue still exists in any specific scenario?
Moving the issue to NR for now.

uttam’s picture

uttam commented
StatusFileSize
new Screenshot from 2025-04-02 17-03-29.png95.83 KB
new Screenshot from 2025-04-02 17-03-13.png89.66 KB
divyansh.gupta’s picture

divyansh.gupta commented
Status: Needs review » Reviewed & tested by the community

Marking this as RTBC. The MR ensures that the JS file is only attached for authenticated users, as expected. It’s a straightforward change and has already been confirmed to work correctly by others. Looks good to go.

the_g_bomb’s picture

the_g_bomb commented

Agreed and confirmed. This appears to be a low-risk and straightforward change. It has a performance benefit and seems to work well.

inregards2pluto made their first commit to this issue’s fork.

inregards2pluto’s picture

inregards2pluto
she/her
commented
StatusFileSize
new autologout-authenticated-user.png31.23 KB
new autologout-anonymous-user.png23.03 KB

Re-tested post https://www.drupal.org/project/autologout/issues/3339695 merge and can confirm behavior is still as expected. Not sure if due to other upstream changes in 2.x or due to patch, but it sounds like maintainers feel that its a low risk and straightforward change, so I'll trust the maintainer powers that be :)

the_g_bomb’s picture

the_g_bomb commented
Status: Reviewed & tested by the community » Fixed

Merged

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

  • the_g_bomb committed 46825537 on add_csrf_protection authored by sandip 
    Issue #3498529: Add JS file only when user is authenticated

  • the_g_bomb committed 46825537 on 8.x-1.x authored by sandip 
    Issue #3498529: Add JS file only when user is authenticated

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.