Hi everyone,
I'm currently investigating an issue in a Reactive Web application and would appreciate any insights or suggestions from the community.
Environment
Problem DescriptionI found a reproducible issue where a user is automatically logged out immediately after the first Aggregate or Data Action executes.
The issue only occurs when the Username contains a semicolon (;).
If the same Username is changed to a value that does not contain ;, everything works as expected.
Question
Has anyone experienced a Reactive app losing its authenticated session or receiving a NotRegisteredException when the Username contains a semicolon (;)?
Are there any known limitations or considerations in OutSystems regarding semicolons in usernames, cookies, or authentication/session handling?
Any suggestions or insights would be greatly appreciated.
Thanks!
Hi @XuyenHoang ,
I am also experiencing the same issue when users access the application.
In my case, the login process completes successfully. However, when the user navigates to the Home page, an Aggregate fails to load and throws a NotRegisteredException. As a result, the user is redirected back to the login screen.
I am still investigating the root cause and trying to understand why this happens after successful authentication.
I'll let you know once I identify the root cause. Meanwhile, you can add a validation during user creation to prevent these unsupported special characters from being entered.
Thanks for the update. I'm still investigating this issue on my side as well.
If you find the root cause, please share it with me. I'll also update this thread if I find anything useful.
I found the root cause of this issue. It is related to the cookie being generated during the login process.
The issue occurs when the username contains a semicolon (;). It gets included in the cookie value and causes incorrect parsing later.
1. Cookie generated when the issue occurs:
Set-Cookie:nr2Users=crf%3dlGk0zJ5f0HERYnwN1pcfUc%2feodg%3d%3buid%3d12%3bunm%3dRahulS%3b; path=/; secure
2. Cookie generated when everything works correctly:
Set-Cookie:nr2Users=crf%3d33mIpRQe%2fpGrrtlAwYgOda3GXH4%3d%3buid%3d12%3bunm%3dRahulS; path=/; secure
After decoding, the values look like this:
Failed: crf=lGk0...eodg=;uid=12;unm=RahulS;
Worked: crf=33mI...GH4=;uid=12;unm=RahulS
The additional semicolon at the end of the username is causing the issue. When the application reads and parses the cookie, it interprets the username incorrectly (RahulS; instead of RahulS).The platform stores the session as key=value pairs separated by ;. The only visible difference is the trailing ; after RahulS in the failed one. That means the stored username in the failing case is RahulS;, with the semicolon as part of the name.
As a result, the user authentication/session validation fails, and the application redirects the user back to the login screen.
Hope this will help you.
Definitely a cookies problem, there are certain characters not allowed as usernames. Semicolons, quotes, double quotes, slashes, asterisks, $'s, etc. are usually not allowed because they have special reserved meaning in programming contexts
Hi @Rahul ,I’ve also investigated this following your analysis above. Since I wasn't completely sure, I'm posting this issue here to get some insights from anyone who has run into this error before.
Hi @Rahul ,
Thank you for your investigation. I’m part of the same development team as XuyenHoang.
We would like to clarify that, in our case, the semicolon (;) exists in the User.Name field, while User.Username does not contain a semicolon.
We also tested the same scenario in another application within the same OutSystems environment, and the issue did not occur. So far, only this specific application is affected.
This makes us wonder whether the unm value in the nr2Users cookie is actually taken from User.Name and whether the issue could be caused by application-specific authentication or cookie-handling logic.
Thanks again for your help.