lams-github

Event Stream, which LAMS uses for reactive communication via Flux, keeps

a line open between browser and LAMS. If this line is considered

stalled, usually because there is no interaction neither on back nor on

front end, it closes. It happens after about 5 minutes.

If in the meantime the teacher navigated to another LAMS lesson via LMS,

he/she gets reauthenticated via integrations mechanism and gets a new

HTTP session ID. This works fine and allows working on multiple

monitoring windows via LMS.

If now the stalled Event Stream sends a message to LAMS, it uses the old

session ID, not the new one. It happens even when the monitoring window

where the Event Stream was created gets closed. It is a browser

"feature".

This request with old session ID gets picked up by LAMS double login

prevention mechanism. LAMS does not allow users to be logged in to same

account on two browsers. And this Event Stream retransmission looks like

a double login. So LAMS invalidates the correct current session.

It results in teacher getting logged out from the monitoring window and

getting the login page on refresh.

The fix is just throwing an exception on Event Stream retransmission

which would otherwise invalidate the current session. It should be good

enough as the Event Stream does not need a valid response, no one is

waiting for one anymore.

Show less