Contrib.social

Checkbox not displayed when session cookie expires and Agreement page is shown again

Open on Drupal.org →
Created on 17 February 2025, about 2 months ago

Problem/Motivation

There is an issue with the Agreement module when the session cookie expires. If the session cookie has expired, the Agreement page is displayed again for anonymous users, but the checkbox to accept the agreement is not visible.

Steps to reproduce

  1. Set the session cookie to expire within a short time (e.g., 1 month).
  2. Visit the website as an anonymous user and accept the privacy agreement.
  3. Wait for the session cookie to expire.
  4. After the session expires, revisit the website. The Agreement page will be shown again.
  5. Notice that the checkbox to accept the agreement is missing.

Expected behavior

When the Agreement page is displayed after the session cookie has expired, the checkbox to accept the agreement should be visible and functional if the user has not previously accepted the agreement.

Actual behavior

After the session cookie expires, the Agreement page is displayed again, but the checkbox to accept the agreement is missing, making it impossible for the user to acknowledge the agreement again.

Environment:

Drupal version: 11.1.2
Agreement module version: 3.0.1
PHP version: 8.3.6
Browser: Firefox/Linux, Vivaldi/Linux, Firefox/Android, Safari
"How often should users be required to accept the agreement" settings: -1 (only once)

Possible cause

It seems that the Agreement module is not handling the session expiration properly, and as a result, it fails to show the checkbox after the session cookie expires.

Additional issue:

When the session cookie expires, the only way to restore proper functionality is by manually deleting the agreement_anon_default cookie. Without this, the Agreement page keeps appearing without the checkbox, preventing anonymous users from accepting the agreement again.

This suggests that the Agreement module does not correctly reset or refresh the agreement_anon_default cookie when a new session starts, leading to a broken state for anonymous users.

Possible solution / workaround

Synchronizing the expiration time of the agreement_anon_default cookie with the session cookie could resolve this issue. If both cookies expire at the same time, the Agreement module would not enter a broken state where the Agreement page is shown without a checkbox. This would ensure that when a new session starts, the Agreement module correctly resets and displays the acceptance option.

Test / Demo

https://r00t.hu

Delete / expire session cookie.

🐛 Bug report
Status

Active

Version

3.0

Component

Code

Created by

7r3y

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @7r3y
  • Comment about 2 months ago →
    🇺🇸United States mradcliffe USA

    Thank you for creating the issue. I'll try to resolve this week.

  • Comment about 1 month ago →
    🇺🇸United States mradcliffe USA

    I mentioned I was going to be able to get to this a couple of weeks ago, but unfortunately I got caught up. I apologize for not addressing it. I will try to review this week.

  • Comment about 1 month ago →
    🇺🇸United States mradcliffe USA

    I have been trying to debug this and find a way to reproduce locally. On a fresh install, agreement with anonymous works fine and no session cookie is used.

    I tried manually setting a session cookie created for an anonymous user and agreeing to the agreement. I navigated around a couple of times. Then I deleted the session cookie and navigated to a node, and since the agreement cookie was still active, then it did not redirect to the agreement page.

    I also tried manually setting a session cookie (in code) for the anonymous user after refreshing cache, agreeing to the agreement after I navigated to a node, then deleted the session cookie, refreshed cache, tried to visit the node, and since the agreement cookie was still active, it did not redirect to the agreement page.

    So I think I need more steps to reproduce.

    A simple workaround in the meantime is to grant the "revoke own agreement" to the anonymous user, which will display the checkbox and button on the agreement form.

    Trying to think about it some more, maybe when checking if hasAnonymousUserAgreed, if the user has a session cookie, then migrate their session so it gets an updated date. If the cookie is gone, then it won't update the session cookie.

  • Comment 23 days ago →
    7r3y

    A simple workaround in the meantime is to grant the "revoke own agreement" to the anonymous user, which will display the checkbox and button on the agreement form.

    The workaround works. Thanks!

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024