Bug: Can access "Create Project" even with an expired session

[NilakshiS]

Describe the bug

I can access the "Create Project" page even with an expired session which should not be possible. I can put all the details for the project but when I try to save the project on any page by clicking the "Save Project" button, I get logged out, redirected to the Login page (the "Leave page and delete unsaved data" warning is displayed first), and get the expired session notification.

Because the bug allows user to use the calculator when the session has expired, the entered data is lost when user finally tries to save.

Currently affects the tdmdev login - Admin ([email protected]) account, unsure if more users are affected.

Steps to reproduce the issue

1. Login to the dev site.

2. Go to "Create Project" page.

3. Wait for the session to expire or "Expire" the session using dev tools.

   Instructions for using Chrome Dev tools to expire the session

   • Open Developer tools in the browser.
   • Go to the "Application" tab in dev tools.
   • From the menu on left, under "Storage" select "Cookies".
   • Click on the item "https://tdm-dev.azurewebsites.net/" if not already selected.
   • In the list of cookies that opens on the right, find the item with the name "jwt".
   • Double click on the value in "Expires/ Max Age" column for the "jwt" item.
   • Change the date to a day before, for example, if it's 2024-09-12T07:44:24.722Z, change it to 2024-09-11T07:44:24.722Z.
   • Click outside the panel to change the value, the "jwt" item will disappear from the list.
   • Close the dev tools.

4. Navigate to "About" page then go back to the "Create Project" page.

What's the expected result?

After the last step, clicking on the "Create Project" button should cause the user to be logged out and:

• Either be redirected to the login page with an expired session notification displayed
• Or stay on the same page with the "expired session" notification and "projects cannot be saved without logging in" notification displayed

What's the actual result?

The user can still enter all the details and is never notified that the project will not be saved at the end. Only when the user clicks the "Save Project" button, they are logged out and expired session notification is displayed.

Additional details / screenshot

An image of the page 5, notice that the user is still shown as logged in and the summary page is displayed

An image of warnings diplayed when "Save Project" is clicked.

Device configuration

• Device: desktop computer
• OS version: Windows 11 OS
• Browser: Chrome
• Browser version: 128.0.6613.121