Session Idle Timeout Not Enforced - User Remains Logged In After 30 Minutes Idle #209
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: Topcoder-Platform/public-website-qa-bug-hunt#209
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Description:
After logging into the application and keeping the app idle for around 30 minutes, the user remains logged in and can still perform actions such as registering for challenges that require an active logged-in state. The application should automatically log out the user after the idle session timeout period to ensure session security and proper user state management.
Current URL:
https://www.topcoder.com/challenges
Steps to reproduce:
Go to https://www.topcoder.com and log in to the application.
Leave the application idle (without any user interaction) for approximately 30 minutes.
Observe the user login state on the app.
Attempt to register for any challenge or perform any action that requires the user to be logged in.
Actual results:
The user remains logged in despite the idle timeout period.
The user can perform all actions that require a logged-in state without being logged out.
Session timeout is not enforced, leading to potential security risks.
Expected results:
The application should automatically log out the user after the idle session timeout period (around 30 minutes).
Any actions requiring logged-in status should redirect or block access if the session has expired.
Proper session management should prevent unauthorized use after idle timeout.
Screenshots/Videos:
OS and Browser version:
Windows 11, Chrome 140.0.7339.186
VersionDetails:
Device:
Windows Laptop
Reproducibility:
5/5 (reproducible every time)