After session times out, the XB page stuck on the error message. Only after a redirect, the login page appears. Ideally, clicking "Try Again" should take the user directly to the login page.
Steps to reproduce:
/xb/node/1/editorBelow are the network errors :
{ "status": 403, "data": { "errors": [ "This route can only be accessed by authenticated users." ] } }
[ "The 'edit xb_page' permission is required." ]
| Comment | File | Size | Author |
|---|---|---|---|
| #24 | Screenshot 2025-08-29 at 11.48.21 AM.png | 91.16 KB | lauriii |
| #23 | Screenshot 2025-08-28 at 8.14.57 PM.png | 174.37 KB | mayur-sose |
| #23 | Screenshot 2025-08-28 at 8.10.25 PM.png | 139.32 KB | mayur-sose |
| #20 | session timeout.gif | 48.62 KB | wim leers |
| #2 | Screenshot 2025-06-26 at 4.18.47 PM.png | 64.9 KB | wim leers |
Show commandsStart within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes
Comments
Comment #2
wim leersThanks, interesting edge case! 😄
Comment #3
wim leersSimilar symptoms as #3509333: After an error it’s possible to get trapped in an unrecoverable error state!
Comment #4
mayur-sose commentedComment #6
bnjmnmComment #8
bnjmnmComment #11
larowlanNeat approach. Can we get a kernel test added for the authentication checker?
Comment #12
bnjmnmYep,! There's a bunch of other tests that need updating too - I just didn't want to do all that refactoring until I got a +1 but now that I have one I'll hop on that.
Comment #13
bnjmnmComment #14
wim leersLooking good! Missing some cacheability bits — provided pointers to prior art.
Two tests are failing:
testAuthenticationRequiredPermission()(👍) — it identified one route definition that still needs to be updatedComment #15
wim leersWould also be nice to get a GIF of this new UI functionality in action 😇
Comment #16
bnjmnmFailing test is just a flaky Playwright
Comment #17
wim leersReopened a thread, because I don't understand the answer: https://git.drupalcode.org/project/experience_builder/-/merge_requests/1...
A mild concern about relying on https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Authentication#... at https://git.drupalcode.org/project/experience_builder/-/merge_requests/1... — but I'm okay with merging as-is.
Just need to get clarity on that one thing 😇
Comment #18
wim leersAhhhhh!
That is why! Reverting my revert, and merging 👍
Comment #19
wim leersComment #20
wim leersManually tested, works well 👍
Comment #22
wim leers🎉
Comment #23
mayur-sose commentedAfter renaming the cookie and reloading the page, I am getting the following session timeout error:
{ "errors": [ "You must be logged in to access this resource." ] }Error 401: You must be logged in to access this resource.
And after clicking on the "Go to login" button, the page is correctly redirected to the login page. This behaviour is working as expected. Now, the page is not getting stuck on the error page.
Comment #24
lauriiiWe need to adjust the errors that are displayed to user in this situation. This isn't really an unexpected error.. This is just the users session timing out?
Comment #25
wim leersYeah, I was thinking that too — but this is such a massive improvement compared to where we were before that I didn't want to push back over this. 😅
Comment #26
lauriii+1 for landing the fix as it is but it would be great to plan for doing #24 too.
Comment #27
wim leersOkay — but what do you expect that to look like? We were flying blind here: empty proposed solution in the issue summary, no designs.
So: the hard part is done — now we just need to tweak it to no longer have this less-than-great UX 😊