Monday, August 25, 2014

Fail to handle the session properly, and make your site useless

I was recently on vacation abroad. Just before taking the flight back home, I embarked on the mundane task of doing the online check-in for my return flight. The process started nicely, on what looked like a modern and well designed site; it was obvious that a lot of care went into creating that site.

Then, I arrived at the page where you need to enter information about yourself and family members traveling with you: passport number, expiration date, address of residence, information about the green card when it applies, and so on. In my case, with 4 family members, that was a pretty long page. I had all the passports handy, but it still took me maybe 10 minutes to enter that information. Apparently, I wasn't fast enough: upon pressing the Next button, I got that dreadful your session has expired message.

I ended up preparing all the information required for the form in a text file, so I could just copy-paste it very quickly, and fill out the form before the session could expire. Check-in done. But I seriously doubt that many people manage to get through this process. See such a nicely designed site completely fail because of a session issue is a shame.

The thing is that doing it right isn't as easy as it seems. You have to deals with competing requirements:

  1. Having a session last for a longer time is worse for security and uses more resources on your servers.
  2. But of course, the session should last long so the site is actually usable, and users don't get a session expired while filling out a form.

Say you setup your server to have the session last only 10 minutes, favoring security and lower resource usage on your server. The issue is that the "counter" typically gets reset every time users submit a form, e.g. click on the next button in a wizard. This means that if you have a long form, you're saying your users must fill it out in less than 10 minutes, which might not be possible. But of course, you can do better:

  1. Why not "reset the counter" every time users fill out a field? This way, whatever the length of the form is, the session will only expire after 10 minutes of true inactivity.
  2. If you want to be more aggressive about keeping the session alive, why not prevent it from expiring as long as users have a tab open pointing to your site?

Orbeon Forms does both. Out-of-the-box1. And we think every site should do the same. (Especially if those I use to check-in before an international flight with 4 family members.)


1 In Orbeon Forms, the feature that keeps the session alive as long as users have a tab open is called session heartbeat. Since doing this does put more strain on your servers, you have the option of disabling session heartbeat.

Thursday, August 7, 2014

Orbeon Forms 4.6.2

Today we released Orbeon Forms 4.6.2 PE. This update to Orbeon Forms 4.6.1 PE contains bug-fixes and localization improvements. We recommend this update for all Orbeon Forms 4.6 PE users. For more details about the 4.6 release in general, see Orbeon Forms 4.6.

This release includes the following bug fixes:
  • Form Builder
    • Incorrect copy/paste of control with warning constraint (#1785)
  • Form Runner
    • Alert for constraint shows instead of alert for required (#1829)
    • Required validation must win over other constraints (#1830)
    • Comma-separated roles fail in persistence layer (#1690)
    • Remove Explanation control from the toolbox unless ready (#1825)
    • Versioned resources have expiration date in the past (#1837)
  • XForms
    • XForms inspector doesn't support copy/paste anymore (#1841)
This release also adds:
  • Swedish localization for Form Builder
  • Updated translations for German and Italian (#1832)
Compatibility notes:
You can download the latest version of Orbeon Forms from the downloads page.
    Don't forget to grab a trial license for the PE version.

    Please send feedback:
    We hope you enjoy this release!