[47854] - Session Destroyed automatically . #8695

marcoAntonioNina · 2026-01-21T12:58:14Z

Issue & Reproduction Steps

The session loss warning when you have multiple tabs does not correctly control the time of each one; the time should be global and synchronized for all of them.

Solution

Implement session synchronization and timeout management in bootstrap.js; enhance Session.vue to utilize session state updates and warnings. This includes adding BroadcastChannel support for session events, localStorage management for session state, and integrating session renewal logic in the Session component.

How to Test

Log in to the ProcessMaker platform.
Open multiple browser tabs, such as:
Editing a screen
Editing a script
Editing a process modeler
Viewing a request page
Work on one of the open screens while leaving the other tabs idle.
After 5–10 minutes, the session automatically expires some time take more than.
When you try to submit changes, an "Unauthorized" message appears, along with a "Stay Connected" prompt.
If you do not click "Stay Connected" or miss the prompt, you are automatically logged out.
As a result, any unsaved changes in screens, scripts, or process models are lost.

Related Tickets & Packages

FOUR-27401

Code Review Checklist

I have pulled this code locally and tested it on my instance, along with any associated packages.
This code adheres to ProcessMaker Coding Guidelines.
This code includes a unit test or an E2E test that tests its functionality, or is covered by an existing test.
This solution fixes the bug reported in the original ticket.
This solution does not alter the expected output of a component in a way that would break existing Processes.
This solution does not implement any breaking changes that would invalidate documentation or cause existing Processes to fail.
This solution has been tested with enterprise packages that rely on its functionality and does not introduce bugs in those packages.
This code does not duplicate functionality that already exists in the framework or in ProcessMaker.
This ticket conforms to the PRD associated with this part of ProcessMaker.

ci:deploy

Note

Introduces a centralized session synchronization mechanism to keep session timeout, warnings, and renewals consistent across browser tabs.

Adds common/sessionSync.js with BroadcastChannel/localStorage-based state, leader election, and a single timeout Web Worker driving cross-tab warnings/expiry
Refactors bootstrap.js and next/config/session.js to initialize initSessionSync, exposing AccountTimeout* globals and sessionSync helpers instead of manual worker wiring
Enhances Session.vue to show a renewing spinner state, disable actions during keep-alive, handle 401/419, and broadcast renewing/renewed/expired/logout events to other tabs; only leader restarts the worker
Extends navbar state/components (app-layout.js, next/layout/navbar.js, Blade) with sessionIsRenewing and passes :is-renewing to the session modal; closing the modal resets renewing state

^{Written by Cursor Bugbot for commit 81cb879. This will update automatically on new commits. Configure here.}

….js; enhance Session.vue to utilize session state updates and warnings. This includes adding BroadcastChannel support for session events, localStorage management for session state, and integrating session renewal logic in the Session component.

…bootstrap.js; update Session.vue to handle session expiration and logout functionality with improved button interactions. Modify session.js to ensure proper handling of timeout warning seconds.

vladyrichter · 2026-01-21T13:39:00Z

QA server K8S was successfully deployed https://ci-4956f1abde.engk8s.processmaker.net

vladyrichter · 2026-01-21T14:48:41Z

QA server K8S was successfully deployed https://ci-4956f1abde.engk8s.processmaker.net

vladyrichter · 2026-01-21T21:53:28Z

QA server K8S was successfully deployed https://ci-4956f1abde.engk8s.processmaker.net

…ion event handling; improving performance and user experience during session management.

…rap.js and Session.vue; update broadcast logic to synchronize logout state across tabs, improving user experience during session termination.

vladyrichter · 2026-01-22T15:28:18Z

QA server K8S was successfully deployed https://ci-4956f1abde.engk8s.processmaker.net

vladyrichter · 2026-01-22T16:45:18Z

QA server K8S was successfully deployed https://ci-4956f1abde.engk8s.processmaker.net

…essages

vladyrichter · 2026-01-22T20:33:35Z

QA server K8S was successfully deployed https://ci-4956f1abde.engk8s.processmaker.net

…ionality in sessionSync.js

cursor

Cursor Bugbot has reviewed your changes and found 3 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

cursor · 2026-01-22T23:44:54Z

resources/js/components/Session.vue

+            return;
+          }
          this.disabled = false;
+          this.setRenewingState(false);


Unsafe error property access causes crash

High Severity

The keepAlive error handler accesses error.response.data.errors without null checking, which throws a TypeError for network errors, timeouts, or server errors that lack the expected structure. This crashes the error handler and prevents proper error recovery when session renewal fails.

cursor · 2026-01-22T23:44:54Z

resources/js/common/sessionSync.js

+      // Only the leader drives the worker countdown.
+      refreshSessionStateFromStorage();
+      startTimeoutWorker(sessionState.timeout);
+    }


Double worker start on visibility change leadership

Low Severity

When a hidden tab becomes visible and claims leadership, the timeout worker receives two "start" messages within milliseconds. The updateLeadership call at line 481 triggers ensureWorkerRunning which starts the worker, then line 488 immediately starts it again, causing the second start to override the first with slightly different timing calculations.

Additional Locations (1)

resources/js/common/sessionSync.js#L454-L458

cursor · 2026-01-22T23:44:55Z

resources/js/common/sessionSync.js

+          workerStarted = false;
+          closeSessionModal();
+        }
+      }


Worker restart blocked when modal unavailable

Medium Severity

When a tab loses leadership, the workerStarted flag reset at line 467 only happens if closeSessionModal exists. In layouts without the session modal, the flag remains true, preventing the timeout worker from restarting when the tab regains leadership. This breaks session timeout functionality when switching between tabs.

vladyrichter · 2026-01-23T00:16:58Z

QA server K8S was successfully deployed https://ci-4956f1abde.engk8s.processmaker.net

processmaker-sonarqube · 2026-01-23T00:31:56Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarQube

marcoAntonioNina added 2 commits January 21, 2026 08:53

Enhance session management by adding clearWarningState invocation in …

91dca6c

…bootstrap.js; update Session.vue to handle session expiration and logout functionality with improved button interactions. Modify session.js to ensure proper handling of timeout warning seconds.

marcoAntonioNina added 2 commits January 21, 2026 09:56

This improves robustness and user experience during session timeouts.

e9b337a

add comments

c15212e

This comment was marked as outdated.

Sign in to view

add loader

3438027

marcoAntonioNina added 2 commits January 22, 2026 10:45

Implement message deduplication logic in bootstrap.js to enhance sess…

2db9d6d

…ion event handling; improving performance and user experience during session management.

Enhance session management by adding manual logout handling in bootst…

bd1e89c

…rap.js and Session.vue; update broadcast logic to synchronize logout state across tabs, improving user experience during session termination.

This comment was marked as outdated.

Sign in to view

Add login in next/Session

df25a80

Enhance session event broadcasting by adding a unique identifier to m…

cf6ce9b

…essages

This comment was marked as outdated.

Sign in to view

Enhance session synchronization by introducing suppress warning funct…

81cb879

…ionality in sessionSync.js

cursor bot reviewed Jan 22, 2026

View reviewed changes

[47854] - Session Destroyed automatically . #8695

Are you sure you want to change the base?

[47854] - Session Destroyed automatically . #8695

Uh oh!

Conversation

marcoAntonioNina commented Jan 21, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue & Reproduction Steps

Solution

How to Test

Related Tickets & Packages

Code Review Checklist

Uh oh!

vladyrichter commented Jan 21, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

vladyrichter commented Jan 21, 2026

Uh oh!

vladyrichter commented Jan 21, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

vladyrichter commented Jan 22, 2026

Uh oh!

vladyrichter commented Jan 22, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

vladyrichter commented Jan 22, 2026

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot Jan 22, 2026

Choose a reason for hiding this comment

Unsafe error property access causes crash

Uh oh!

cursor bot Jan 22, 2026

Choose a reason for hiding this comment

Double worker start on visibility change leadership

Uh oh!

cursor bot Jan 22, 2026

Choose a reason for hiding this comment

Worker restart blocked when modal unavailable

Uh oh!

vladyrichter commented Jan 23, 2026

Uh oh!

processmaker-sonarqube bot commented Jan 23, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

marcoAntonioNina commented Jan 21, 2026 •

edited by cursor bot

Loading