<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I think that seems to work!</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I just wrapped my main actions with a setTimeout:</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
setTimeout(function(){</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
if (btn.disabled) {</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
event.preventDefault();</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
} else {</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
btn.disabled = true;</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
}</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
},0)</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="mail-editor-reference-message-container">
<div style="padding: 3pt 0in 0in; border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(181, 196, 223) currentcolor currentcolor;">
<div style="text-align: left; font-family: Aptos; font-size: 12pt; color: black;">
<b>From: </b>John Salter <J.Salter@leeds.ac.uk><br>
<b>Date: </b>Sunday, October 11, 2026 at 3:02 PM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Cc: </b>Mak, Steven <makst@upenn.edu><br>
<b>Subject: </b>Re: Login form double submit<br>
<br>
</div>
</div>
<div id="mail-editor-reference-message-body">
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr;">
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
When you have the script enabled, does the payload sent to the server include the button value?</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
I wonder whether setting the button to disabled is preventing the button value being posted, and this is breaking the expected flow.</div>
<div class="elementToProof" style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
If the value isn't being sent but needs to be, something similar to this: <a href="https://urldefense.com/v3/__https://stackoverflow.com/a/68053815__;!!IBzWLUs!VPBUB1sDdT_gtQJDYYBSbjTsBCdlG4Akwz6C7iMgJUQPHPcUsyawt5RzFaanqNL11EJSIo5YFk75YmmbI_w$" data-outlook-id="20737a34-3251-4fc9-9faf-15644a046bdc">
https://stackoverflow.com/a/68053815</a> (a zero-second timeout to disable the submit) might work.</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr;">
<br>
</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<hr style="display: inline-block; width: 98%;">
<div class="ms-outlook-mobile-reference-message skipProofing" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<b>From:</b> users <users-bounces@shibboleth.net> on behalf of Mak, Steven via users <users@shibboleth.net><br>
<b>Sent:</b> Sunday, October 11, 2026 18:43<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Cc:</b> Mak, Steven <makst@upenn.edu><br>
<b>Subject:</b> Re: Login form double submit</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<table class="ms-outlook-mobile-reference-message skipProofing" align="center" cellspacing="0" cellpadding="0" border="0" style="width: 500px;">
<tbody>
<tr>
<td class="ms-outlook-mobile-reference-message skipProofing" style="background-color: rgb(187, 165, 85); padding: 5.25pt 5.5pt 5.25pt 1.5pt;">
</td>
<td class="ms-outlook-mobile-reference-message skipProofing" style="text-align: left; background-color: rgb(255, 229, 153); padding: 5.25pt 3.75pt 5.25pt 11.25pt; color: rgb(33, 33, 33);">
<p class="ms-outlook-mobile-reference-message skipProofing" style="text-align: left;">
<span style="font-family: Arial, sans-serif; font-size: 10pt;"><b>CAUTION:</b> External Message. Use caution opening links and attachments.</span></p>
</td>
<td class="ms-outlook-mobile-reference-message skipProofing" style="background-color: rgb(187, 165, 85); padding: 5.25pt 5.5pt 5.25pt 1.5pt;">
</td>
</tr>
</tbody>
</table>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I've tried this and variations of this, but whenever I test this the form doesn't go through at all and it just reloads the same page and same execution step.</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I see the POST in my web server but when I have the script on it returns a 200 status code (response content is the same login page), and when I disable the script it returns a 302 status code to the next execution step.</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
It makes no sense to me why this is happening.</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="x_mail-editor-reference-message-container">
<div style="padding: 3pt 0in 0in; border-top: 1pt solid rgb(181, 196, 223);">
<div style="text-align: left; font-family: Aptos; font-size: 12pt; color: black;">
<b>From: </b>users <users-bounces@shibboleth.net> on behalf of Russell Jackson via users <users@shibboleth.net><br>
<b>Date: </b>Friday, October 9, 2026 at 4:06 PM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Cc: </b>Russell Jackson <Russell.Jackson@csusb.edu><br>
<b>Subject: </b>Re: Login form double submit<br>
<br>
</div>
</div>
<div id="x_mail-editor-reference-message-body">
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
// Prevent double login form POSTs leading to a stale request</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
document.addEventListener("DOMContentLoaded", function() {</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
const form = document.getElementById("fm1");</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
const button = document.getElementById("signin");</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
form.addEventListener("submit", function(event) {</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
if (button.disabled) {</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
event.preventDefault();</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
}</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
else {</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
button.disabled = true;</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
}</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
});</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
});</div>
<div id="x_ms-outlook-mobile-body-separator-line" dir="ltr">
<div style="direction: ltr;"><br>
</div>
</div>
<div id="x_ms-outlook-mobile-signature">
<div style="direction: ltr;">-- </div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Russ</div>
</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="x_mail-editor-reference-message-container">
<div style="padding: 3pt 0in 0in; border-top: 1pt solid rgb(181, 196, 223);">
<div style="text-align: left; font-family: Aptos; font-size: 12pt; color: black;">
<b>From: </b>users <users-bounces@shibboleth.net> on behalf of Scott Cantor via users <users@shibboleth.net><br>
<b>Date: </b>Friday, October 9, 2026 at 12:52 PM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Cc: </b>Scott Cantor <scott@restingparrotsoftware.com><br>
<b>Subject: </b>Re: Login form double submit<br>
<br>
</div>
</div>
<div id="x_mail-editor-reference-message-body">
<div style="font-size: 11pt;">I vaguely thought the default view had some Javascript in it to prevent this, but all it does is rename the button to try and discourage it, so my memory must be faulty. I checked my pre-retirement files and no difference.<br>
<br>
If somebody knows how to do it and donates a patch, I will commit it. Nothing would be bulletproof, but something that disables the button somehow added to the existing onClick function is probably the closest.<br>
<br>
The iPad's handling of the keyboard with web sites is truly abysmal, speaking as an iPad user.<br>
<br>
-- Scott<br>
<br>
--<br>
For Consortium Member technical support, see <a href="https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!IBzWLUs!TftOJY8rIZfZlbU0MBW0CZcs_-Y5RO1WAMHXut1nxmdEliOuvr8hxw17s1GRSP1nNnCFKkVJZoljitwA$" id="OWA397ee465-7704-3c66-a815-df1d3e5432d8" class="OWAAutoLink" originalsrc="https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!IBzWLUs!TftOJY8rIZfZlbU0MBW0CZcs_-Y5RO1WAMHXut1nxmdEliOuvr8hxw17s1GRSP1nNnCFKkVJZoljitwA$" data-auth="NotApplicable" data-outlook-id="f3804559-6633-498f-9aeb-dca980f02002">
https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C02%7Crussell.jackson%40csusb.edu%7C6d9762adec96475b53b008df263ed475%7Cd73b9eaa07c947c4a6cef13bee0e8117%7C0%7C0%7C639271723445319272%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=usg059fl0P89mCvBisH%2B3qPoFdGrBED3kQJADXoPu80%3D&reserved=0</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>