<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" dir="ltr">
I've tried this and variations of this, but whenever I test this the form doesn't go through at all and it just reloads the same page and same execution step.</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" dir="ltr">
<br>
</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" dir="ltr">
I see the POST in my web server but when I have the script on it returns a 200 status code (response content is the same login page), and when I disable the script it returns a 302 status code to the next execution step.</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" dir="ltr">
<br>
</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" dir="ltr">
It makes no sense to me why this is happening.</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" dir="ltr">
<br>
</div>
<div id="mail-editor-reference-message-container">
<div style="padding: 3pt 0in 0in; border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(181, 196, 223) currentcolor currentcolor;">
<div style="text-align: left; font-family: Aptos; font-size: 12pt; color: black;">
<b>From: </b>users <users-bounces@shibboleth.net> on behalf of Russell Jackson via users <users@shibboleth.net><br>
<b>Date: </b>Friday, October 9, 2026 at 4:06 PM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Cc: </b>Russell Jackson <Russell.Jackson@csusb.edu><br>
<b>Subject: </b>Re: Login form double submit<br>
<br>
</div>
</div>
<div id="mail-editor-reference-message-body">
<div class="ms-outlook-mobile-reference-message skipProofing" dir="ltr"></div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
// Prevent double login form POSTs leading to a stale request</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
document.addEventListener("DOMContentLoaded", function() {</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
const form = document.getElementById("fm1");</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
const button = document.getElementById("signin");</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
form.addEventListener("submit", function(event) {</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
if (button.disabled) {</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
event.preventDefault();</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
}</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
else {</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
button.disabled = true;</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
}</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
});</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
});</div>
<div id="ms-outlook-mobile-body-separator-line" dir="ltr"><br>
</div>
<div id="ms-outlook-mobile-signature" dir="ltr">
<div>-- </div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Russ</div>
</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="mail-editor-reference-message-container">
<div style="padding: 3pt 0in 0in; border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(181, 196, 223) currentcolor currentcolor;">
<div style="text-align: left; font-family: Aptos; font-size: 12pt; color: black;">
<b>From: </b>users <users-bounces@shibboleth.net> on behalf of Scott Cantor via users <users@shibboleth.net><br>
<b>Date: </b>Friday, October 9, 2026 at 12:52 PM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Cc: </b>Scott Cantor <scott@restingparrotsoftware.com><br>
<b>Subject: </b>Re: Login form double submit<br>
<br>
</div>
</div>
<div id="mail-editor-reference-message-body">
<div class="ms-outlook-mobile-reference-message skipProofing" dir="ltr">
<meta name="Generator" content="Microsoft Exchange Server">
</div>
<div class="PlainText" style="font-size: 11pt;">I vaguely thought the default view had some Javascript in it to prevent this, but all it does is rename the button to try and discourage it, so my memory must be faulty. I checked my pre-retirement files and no
difference.<br>
<br>
If somebody knows how to do it and donates a patch, I will commit it. Nothing would be bulletproof, but something that disables the button somehow added to the existing onClick function is probably the closest.<br>
<br>
The iPad's handling of the keyboard with web sites is truly abysmal, speaking as an iPad user.<br>
<br>
-- Scott<br>
<br>
--<br>
For Consortium Member technical support, see <a href="https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!IBzWLUs!TftOJY8rIZfZlbU0MBW0CZcs_-Y5RO1WAMHXut1nxmdEliOuvr8hxw17s1GRSP1nNnCFKkVJZoljitwA$" data-outlook-id="f3804559-6633-498f-9aeb-dca980f02002">
https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C02%7Crussell.jackson%40csusb.edu%7C6d9762adec96475b53b008df263ed475%7Cd73b9eaa07c947c4a6cef13bee0e8117%7C0%7C0%7C639271723445319272%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=usg059fl0P89mCvBisH%2B3qPoFdGrBED3kQJADXoPu80%3D&reserved=0</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net</div>
</div>
</div>
</div>
</div>
</body>
</html>