[ADMINCTR-395] Exporting / downloading magnolia app content triggers "unload"-Event of page window Created: 31/May/23  Updated: 21/Jun/23

Status: Open
Project: Admincentral
Component/s: None
Affects Version/s: 6.2.27
Fix Version/s: None

Type: Bug Priority: Major
Reporter: Wolf Bubenik Assignee: Unassigned
Resolution: Unresolved Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

Custom code:
Implemented security improvement - close magnolia admincentral session when user closes browser tab.

  • add java script function "uiUnload" to current UI page: invalidate magnolia session
  • register uiUnload function for events "beforeunload" and "unload" at UI page javaScript
    • UI.getCurrent().getPage().getJavaScript().execute("window.addEventListener('unload', " + FN_UI_UNLOADED + ");");

Issue Links:
relation
Template:
Acceptance criteria:
Empty
Date of First Response:
Visible to:
Joerg von Frantzius, Wolf Bubenik
Epic Link: AuthorX Support
Team: AuthorX

 Description   

Steps to reproduce

  1. register java script function for page window event "unload"
  2. download some content from admincentral (asset, translations, yaml/xml from jcr browser...)

.. Logs, screenshots, gifs...

Expected results

  • the java-script function registered for the unload event is NOT called
  • downloading some content (file) should not trigger the same java-script page events as closing the browser tab

Actual results

  • the java-script function registered for the unload event IS called
  • Within the java-script function I cannot distinguish between a download and closing the browser tab

Workaround

  • setting a marker session attribute when executing an export command and do not execute "unload"-function if present
  • not a got idea because this meeas to overwrite several commands in several modules

Development notes

For our use case (invalidate magnolia session when closing the browser or it's tab) this has the effect that the user get's logged out when exporting some content.

Any suggestions for an alternative implementation?



 Comments   
Comment by Roman Kovařík [ 01/Jun/23 ]

Hi wolf.bubenik,

 

Looks like this is a browser behaviour as described here:

The most common case is if the user clicks a link that starts a download. In that case the browser will fire the event immediately when the user clicks the link. Slightly later when the browser receives the response headers, it will discover that it's a download and not a new HTML page to display. The end result is then that beforeunload has been fired but the previous page is still kept running.

https://stackoverflow.com/questions/56651887/vaadin-onbeforeunload-event

There are some pointers how to workaround this from Leif from Vaadin. 

 

Hope that helps

Roman

Comment by wolf bubenik [ 01/Jun/23 ]

Thanks a lot, @Roman. This helps understanding what is going on. As I see it, there is not much (nothing) you can do about it.

What I want to achieve is to invalidate the magnolia session when the user closes the browser tab without logging out. Unluckily at least some browsers (Firefox) only trigger "beforeunload" in this situation, but not "unload".

Comment by wolf bubenik [ 01/Jun/23 ]

Hi Roman, I googled a bit and found that it is a general problem to trigger some action like logout when closing the browser tab or browser.

  • I have to react on the "beforeunload" event
  • This event is fired whenever I leave the page: navigation, page reload, closing tab... and downloading something...

The most promising solution I found (the one I understand ) is to bind a function to all events we want to ignoere (click link, press F5...) and set a flag that this is a valid action:

See:

$(document).ready(function(){         

        var validNavigation = false;

        // Attach the event keypress to exclude the F5 refresh (includes normal refresh)
        $(document).bind('keypress', function(e) {
            if (e.keyCode == 116){
                validNavigation = true;
            }
        });

        // Attach the event click for all links in the page
        $("a").bind("click", function() {
            validNavigation = true;
        });

        // Attach the event submit for all forms in the page
        $("form").bind("submit", function() {
          validNavigation = true;
        });

        // Attach the event click for all inputs in the page
        $("input[type=submit]").bind("click", function() {
          validNavigation = true;
        }); 

        window.onbeforeunload = function() {                
            if (!validNavigation) {     
                // ------->  code comes here
            }
        };

  }); 

Than we check this flag before doing the logout.

How to do this with magnolia?

Generated at Sun Feb 11 23:06:44 CET 2024 using Jira 9.4.2#940002-sha1:46d1a51de284217efdcb32434eab47a99af2938b.