Login form double submit

[Mak, Steven]

I've tried this and variations of this, but whenever I test this the form doesn't go through at all and it just reloads the same page and same execution step.

I see the POST in my web server but when I have the script on it returns a 200 status code (response content is the same login page), and when I disable the script it returns a 302 status code to the next execution step.

It makes no sense to me why this is happening.

From: users <users-bounces at shibboleth.net> on behalf of Russell Jackson via users <users at shibboleth.net>
Date: Friday, October 9, 2026 at 4:06 PM
To: Shib Users <users at shibboleth.net>
Cc: Russell Jackson <Russell.Jackson at csusb.edu>
Subject: Re: Login form double submit

// Prevent double login form POSTs leading to a stale request
document.addEventListener("DOMContentLoaded", function() {
  const form = document.getElementById("fm1");
  const button = document.getElementById("signin");
  form.addEventListener("submit", function(event) {
    if (button.disabled) {
      event.preventDefault();
    }
    else {
      button.disabled = true;
    }
  });
});

--
Russ

From: users <users-bounces at shibboleth.net> on behalf of Scott Cantor via users <users at shibboleth.net>
Date: Friday, October 9, 2026 at 12:52 PM
To: Shib Users <users at shibboleth.net>
Cc: Scott Cantor <scott at restingparrotsoftware.com>
Subject: Re: Login form double submit

I vaguely thought the default view had some Javascript in it to prevent this, but all it does is rename the button to try and discourage it, so my memory must be faulty. I checked my pre-retirement files and no difference.

If somebody knows how to do it and donates a patch, I will commit it. Nothing would be bulletproof, but something that disables the button somehow added to the existing onClick function is probably the closest.

The iPad's handling of the keyboard with web sites is truly abysmal, speaking as an iPad user.

-- Scott

--
For Consortium Member technical support, see https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C02%7Crussell.jackson%40csusb.edu%7C6d9762adec96475b53b008df263ed475%7Cd73b9eaa07c947c4a6cef13bee0e8117%7C0%7C0%7C639271723445319272%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=usg059fl0P89mCvBisH%2B3qPoFdGrBED3kQJADXoPu80%3D&reserved=0<https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!IBzWLUs!TftOJY8rIZfZlbU0MBW0CZcs_-Y5RO1WAMHXut1nxmdEliOuvr8hxw17s1GRSP1nNnCFKkVJZoljitwA$>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20261011/3892de26/attachment.htm>