10

There are a couple of web applications that I use that seem to require two successive logins. Not two steps, but two full logins. The behavior is such that I login in, get kicked out, then have to login again, with the second effort keeping me logged in. I do not experience this on most sites.

An example is AWS console. I log in, the console starts to load, and then I have to log in again. There is another web application that I use that behaves the exact same way. Login, landing page starts to load, and then I have to login again. Occasionally, they work on the first try, but it's very rare.

What is going on with these sites that this happens? Is this a JSON web token (JWT) issue?

Relevant behavior: This is a once-a-day kind of thing. So once logged in, I can log out/in without incident for the day (I think 24 hours). So, if I wait about 24 hours or longer to login after logging out, the double login behavior returns.

This is why I suspect JWT has a least something to do with this behavior. At least in part.

8
  • Do you always use the same account for those logins, or do you have multiple accounts for the same site?
    – jcaron
    Nov 2, 2023 at 12:53
  • @jcaron Same account for each login. For AWS were I do use two accounts, I literally use different browsers specific to each account. So this behavior occurs in different browsers too (Chrome , Safari). Nov 2, 2023 at 12:55
  • 1
    I've noticed this from Comcast recently. It asks for the password twice, but not the username. I assume it's a bug, not by design.
    – Barmar
    Nov 2, 2023 at 15:36
  • FWIW, some sites require logging in again to access the settings, especially when there are "dangerous" options there, such as account deletion, but this is not this case.
    – Trang Oul
    Nov 3, 2023 at 8:24
  • I guess it's all inability to do it correctly: For example in vSphere I see this: If you fill in an "old" (that is it's loaded for some hours) login form with correct data, you get a message that the login failed, and you should follow a link to do it again. However when following the link you are logged in!
    – U. Windl
    Nov 3, 2023 at 12:00

3 Answers 3

25

In addition to the other answers, it's possible that you have bookmarked a logout link, so every time you try to access the app, you are first propmpted to authenticate, and then sent to the logout page you originally requested.

3
  • 12
    This is interesting because there are systems where some links have "session state" in URLs which effectively act as logout links if that state in URL is invalid - for example, if they were bookmarked some time ago.
    – Peteris
    Nov 2, 2023 at 1:37
  • 1
    Good thought, but I am certain that for both webs, the login is done after clicking the login button, then entering credentials, etc... Nov 2, 2023 at 12:53
  • @RoyHinkley The answer says that maybe you're logging into the log out page.
    – user253751
    Nov 3, 2023 at 22:14
14

It may happen when the apparent application is shared among different sub-applications. When this happens, the various sub-applications should be able to share some information, at least the fact that a client has been authenticated.

But it may not always be trivial. I once experienced a system composed of two applications that presented different views over the same data. They were initially designed for the credentials presented to the first one to automatically validate access to the second one. But the login system had been slightly modified to make use of an existing SSO access control. And patatras, that was enough to break the communication of a client identity.

What I mean here, is that securely exchanging client identity between web application is not a trivial task and is very easy to break. In that case, the clients feel that they have to identify twice on the same system, while in fact they identify once, but on two distinct applications.

6
  • 7
    Many modern systems are very good about hiding the fact that you're actually using several separate systems designed to look like one big unified application. When some of those parts are third-party systems outside your control, credential sharing can become a hard problem to solve. Re-prompting for credentials can be the easy way out.
    – bta
    Nov 1, 2023 at 22:06
  • 7
    An example I personally encounter regularly: I signed up for BitBucket before they were bought by Atlassian. If you were to sign up now, you would only need Atlassian's SSO login with Atlassian ID, but since I have a legacy account, I need to first log into Atlassian ID, then into BitBucket. More precisely, I need to provide my login and password only once, but I need to provide both TOTPs. Nov 1, 2023 at 22:56
  • 6
    Authentication to multiple Services is sometimes implemented via Third-Party-Cookies. If your Browser blocks them (for privacy reasons) this can lead to multiple logins.
    – Falco
    Nov 2, 2023 at 9:51
  • 2
    That's common, from my experience. Development of large web applications is done by seperate teams, login is bypassed, not implemented or simplified during development to allow easy testing and integration of features and is often left to the last moment both by developers and architects
    – Rsf
    Nov 2, 2023 at 10:08
  • 4
    @Falco You may be on the right track here. Our company's policy is block 3-party cookies by default for security reasons. We do open up specific 3-party cookies when necessary. I will look into this a bit more. Thank you. Nov 2, 2023 at 13:17
3

This has little to do with two-factor authentication (2FA) nor is it a replacement for it.

Reauthentication as part of regular authentication process is unlikely and uncommon to my knowledge. However, high risk functionality (such as a accessing a server console) could require (re-)authentication to ensure the credentials are known to the user. Protecting against misuse in case of for example a unattended device with unlocked screen and active session.

This can be also seen for example with certain data export functionality that contain highly confidential or high amounts of data.

4
  • 1
    or to use InfoSec words: If your threat model informs you that you have the threat of people abusing already authenticated users for elevated processes. your mitigation could be to require a re-auth to ensure the user has acces to the authorization to access the elevated process.
    – LvB
    Nov 1, 2023 at 13:21
  • 1
    Possible, but I don't think that is what is happening here. In the AWS case, it takes me to the AWS main home page itself (aws.amazon.com) with the Sign In To Console button, not the login page for the particular console I am logging in to. With the other site, there is an error message which I cannot generate, because the issue only happens once a day - which is why I suspect JWT. Nov 1, 2023 at 13:46
  • 1
    I'm unfamiliar with AWS consoles specifically. It could be wrong implementation such as using another (sub) domain for two things without properly accounting for that in the authentication process.
    – Bob Ortiz
    Nov 1, 2023 at 14:06
  • 2
    AWS will often do this if you have multiple different tabs or windows open, especially when assuming roles.
    – barbecue
    Nov 2, 2023 at 17:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .