I’m writing a Catalyst application that’s required to have a fairly short session expiration (15 minutes). I’m using the standard Catalyst framework authentication modules, so the user data is stored in the session — i.e., when your session expires, you get logged out.
Many of the uses of this application will require >15 minutes to complete, so users will frequently submit a form only to find their session state is gone and they’re required to log back in.
If this happens I want to preserve the original form submission, and if they log in successfully, continue on and carry out the form submission just as if the session had not expired.
I’ve got the authentication stuff being handled by an auto() method in the controller — if you request an action that requires authentication and you’re not currently logged in, you get redirected to the login() method, which displays the login form and then processes it once it’s submitted. It seems like it should be possible to store the request and any form parameters when the auto method redirects to the login(), and then pull them back out if the login() succeeds — but I’m not entirely sure of the best way to grab or store this information in a generic/standard/reusable way. (I’m figuring on storing it in the session and then deleting it once it’s pulled back out; if that seems like a bad idea, that’s something else to address.)
Is there a standard ‘best practices’ or cookbook way to do this?
(One wrinkle: these forms are being submitted via POST.)
In the end, we ended up grabbing the pending request (URL+params) in the auto(), serializing and encrypting it, and passing it via a hidden form element on the login page. If we got a login request with the hidden element populated, we decrypted and deserialized it and then redirected appropriately (making sure to pass through the standard ‘can this user do this thing’ code paths).