Closed (fixed)
Project:
Persistent Login
Version:
4.7.x-1.x-dev
Component:
Code
Priority:
Normal
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
2 Jan 2007 at 04:33 UTC
Updated:
18 Jan 2007 at 20:25 UTC
If I login the site with 'remember me' enabled, then I can see the following text at my user information (http://yoursite.com/user/)
Remembered logins
You have 1 persistent login session(s) created with the "Remember Me" login option on this site.
Erase persistent logins now (this will not log you out)
But if I change my password and click 'submit' button, then the above text disappears and hence persistent login expires. (http://yoursite.com/user//edit)
Is this bug or feature?
Thanks
Comments
Comment #1
moshe weitzman commentedi can confirm this. seems like just submitting the edit page destroys your persistent login.
IMO, i would prefer to bury the persisten login clear option within the Edit profile page. It is a bit too visible/confusing for the average user on his profile page.
Comment #2
bjaspan commentedRegarding the disappearing persistent login when you submit the user edit form, that is intentional. It seems prudent to do so. I could make it so that the PL is only wiped when the password is changed instead of when the form is submitted for any changes. What do you think?
Regarding moving the "click here to erase" somewhere else, I could go either way. The downside to moving it is that few/no sites actually provide it so users do not expect the feature to exist and won't even think to look for it should they want to wipe the PLs. OTOH, they also probably won't think to even realize they should.
Since PL can detect stolen login cookies and automatically wipes them when that occurs, perhaps the "click here to erase" isn't necessary. I guess it can be buried in the edit form.
I'm on vacation and will deal with this when I return.
Comment #3
moshe weitzman commentedmy vote is to move the erase feature to edit and to only clear PL on password change.
Comment #4
bjaspan commentedI changed PL so stored persistent logins are only erased when the password is changed, not whenever the user form is submitted.
I improved the "you have N remembered logins" text but left it on the user account page (moved from History section to Security section). I think it is important for users to know this feature is available.
Fixes are on the 4.7 and 5 development branch.
Comment #5
bjaspan commented