Login form double submit

[Mak, Steven]

I think that seems to work!

I just wrapped my main actions with a setTimeout:

setTimeout(function(){
    if (btn.disabled) {
        event.preventDefault();
    } else {
        btn.disabled = true;
    }
},0)

From: John Salter <J.Salter at leeds.ac.uk>
Date: Sunday, October 11, 2026 at 3:02 PM
To: Shib Users <users at shibboleth.net>
Cc: Mak, Steven <makst at upenn.edu>
Subject: Re: Login form double submit

When you have the script enabled, does the payload sent to the server include the button value?
I wonder whether setting the button to disabled is preventing the button value being posted, and this is breaking the expected flow.

If the value isn't being sent but needs to be, something similar to this: https://stackoverflow.com/a/68053815<https://urldefense.com/v3/__https://stackoverflow.com/a/68053815__;!!IBzWLUs!VPBUB1sDdT_gtQJDYYBSbjTsBCdlG4Akwz6C7iMgJUQPHPcUsyawt5RzFaanqNL11EJSIo5YFk75YmmbI_w$> (a zero-second timeout to disable the submit) might work.


________________________________
From: users <users-bounces at shibboleth.net> on behalf of Mak, Steven via users <users at shibboleth.net>
Sent: Sunday, October 11, 2026 18:43
To: Shib Users <users at shibboleth.net>
Cc: Mak, Steven <makst at upenn.edu>
Subject: Re: Login form double submit


CAUTION: External Message. Use caution opening links and attachments.

I've tried this and variations of this, but whenever I test this the form doesn't go through at all and it just reloads the same page and same execution step.

I see the POST in my web server but when I have the script on it returns a 200 status code (response content is the same login page), and when I disable the script it returns a 302 status code to the next execution step.

It makes no sense to me why this is happening.

From: users <users-bounces at shibboleth.net> on behalf of Russell Jackson via users <users at shibboleth.net>
Date: Friday, October 9, 2026 at 4:06 PM
To: Shib Users <users at shibboleth.net>
Cc: Russell Jackson <Russell.Jackson at csusb.edu>
Subject: Re: Login form double submit

// Prevent double login form POSTs leading to a stale request
document.addEventListener("DOMContentLoaded", function() {
  const form = document.getElementById("fm1");
  const button = document.getElementById("signin");
  form.addEventListener("submit", function(event) {
    if (button.disabled) {
      event.preventDefault();
    }
    else {
      button.disabled = true;
    }
  });
});

--
Russ

From: users <users-bounces at shibboleth.net> on behalf of Scott Cantor via users <users at shibboleth.net>
Date: Friday, October 9, 2026 at 12:52 PM
To: Shib Users <users at shibboleth.net>
Cc: Scott Cantor <scott at restingparrotsoftware.com>
Subject: Re: Login form double submit

I vaguely thought the default view had some Javascript in it to prevent this, but all it does is rename the button to try and discourage it, so my memory must be faulty. I checked my pre-retirement files and no difference.

If somebody knows how to do it and donates a patch, I will commit it. Nothing would be bulletproof, but something that disables the button somehow added to the existing onClick function is probably the closest.

The iPad's handling of the keyboard with web sites is truly abysmal, speaking as an iPad user.

-- Scott

--
For Consortium Member technical support, see https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C02%7Crussell.jackson%40csusb.edu%7C6d9762adec96475b53b008df263ed475%7Cd73b9eaa07c947c4a6cef13bee0e8117%7C0%7C0%7C639271723445319272%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=usg059fl0P89mCvBisH%2B3qPoFdGrBED3kQJADXoPu80%3D&reserved=0<https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!IBzWLUs!TftOJY8rIZfZlbU0MBW0CZcs_-Y5RO1WAMHXut1nxmdEliOuvr8hxw17s1GRSP1nNnCFKkVJZoljitwA$>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20261011/a39cb899/attachment.htm>