## [Bug] Lesson Progress and Account State Are Lost After ~10 Minutes of Inactivity (AFK) #221

New Issue

2026-06-08T19:30:43Z

enjin2310 commented

2026-06-08 19:30:43 +00:00

🧩 Summary

After remaining inactive for approximately 10 minutes, the user session is automatically terminated. Upon logging back in, all previously completed lesson progress is lost, including saved advancement states. This severely impacts learning continuity and results in critical data loss.

🧪 Steps to Reproduce

Log into the SpikerSoft Learn platform.
Complete several lessons in any Playground (C#, Python, JS, etc.).
Stay AFK (no interaction) for at least 10 minutes.
Observe that the session automatically expires.
Log in again.
Notice that lesson progress is not preserved.

✅ Expected Behavior

The session should remain active for a reasonable period (30–60 minutes) before expiring due to inactivity.
Even if the session expires, lesson progress should persist in the user account.
Progress should sync automatically with the server in real time or upon completing each lesson.

❌ Actual Behavior

The session expires too quickly (≈10 minutes).
When the session expires, lesson progress is lost.
Users must redo lessons they had already completed.
The learning experience becomes interrupted and frustrating.

📸 Evidence

User reports that after returning from an AFK period, all previously completed lessons appeared as incomplete.

🧠 Possible Root Cause

Session expiration timeout set too low in the authentication server.
Missing automatic progress synchronization with the database.
Progress stored in session memory instead of persistent storage.
Session token not being renewed via silent refresh.

🔧 Suggested Fix

Increase session expiration time to a standard value (30–60 minutes).
Implement automatic progress saving whenever a lesson is completed.
Enable silent token refresh to prevent unexpected logouts.
Ensure progress is stored in persistent user data, not volatile session memory.
Perform extended AFK testing to validate persistence.

🔍 Additional Recommendation

Conduct a full audit of the authentication system and progress‑tracking module to ensure:

Lesson progress does not depend on session state.
No other scenarios exist where progress can be lost.

🌐 Environment

URL: learn.spikersoft.com
Version: v2026.06.08a
Browser: Edge (latest)
OS: Windows 10.0
User: Jorge (logged in)

### 🧩 Summary After remaining inactive for approximately **10 minutes**, the user session is automatically terminated. Upon logging back in, **all previously completed lesson progress is lost**, including saved advancement states. This severely impacts learning continuity and results in critical data loss. ### 🧪 Steps to Reproduce 1. Log into the SpikerSoft Learn platform. 2. Complete several lessons in any Playground (C#, Python, JS, etc.). 3. Stay AFK (no interaction) for at least **10 minutes**. 4. Observe that the session automatically expires. 5. Log in again. 6. Notice that lesson progress **is not preserved**. ### ✅ Expected Behavior - The session should remain active for a reasonable period (30–60 minutes) before expiring due to inactivity. - Even if the session expires, **lesson progress should persist** in the user account. - Progress should sync automatically with the server in real time or upon completing each lesson. ### ❌ Actual Behavior - The session expires too quickly (≈10 minutes). - When the session expires, lesson progress is lost. - Users must redo lessons they had already completed. - The learning experience becomes interrupted and frustrating. ### 📸 Evidence User reports that after returning from an AFK period, all previously completed lessons appeared as incomplete. ### 🧠 Possible Root Cause - Session expiration timeout set too low in the authentication server. - Missing automatic progress synchronization with the database. - Progress stored in session memory instead of persistent storage. - Session token not being renewed via *silent refresh*. ### 🔧 Suggested Fix 1. **Increase session expiration time** to a standard value (30–60 minutes). 2. Implement **automatic progress saving** whenever a lesson is completed. 3. Enable **silent token refresh** to prevent unexpected logouts. 4. Ensure progress is stored in persistent user data, not volatile session memory. 5. Perform extended AFK testing to validate persistence. ### 🔍 Additional Recommendation Conduct a full audit of the authentication system and progress‑tracking module to ensure: - Lesson progress does not depend on session state. - No other scenarios exist where progress can be lost. ### 🌐 Environment - **URL:** learn.spikersoft.com - **Version:** v2026.06.08a - **Browser:** Edge (latest) - **OS:** Windows 10.0 - **User:** Jorge (logged in)

spikerj commented

2026-06-09 15:44:47 +00:00

Resolved in spikersoft-angular PR #29 (merged).

Root cause (two compounding bugs):

Aggressive idle logout — keycloak-angular auto-refresh was set to a 5-min inactivity window with onInactivityTimeout: "logout", so an idle user was hard-logged-out instead of silently refreshed (~5 min idle + remaining access-token lifespan ≈ the ~10 min reported).
Non-durable local passes — server-graded challenges and tutorials persist to Mongo synchronously, but browser-graded lessons (C#/Python/JS WASM) only became durable after the offline outbox flushed to /Lessons/progress/batch. If the forced logout fired first, the pass was stranded and re-login showed it incomplete.

Fix shipped:

Session: sessionTimeout 5→30 min and onInactivityTimeout logout→login (silent re-auth via check-sso).
Durability: flush the outbox on pagehide / visibilitychange (hidden) and before manual logout.
Integrity: user-scope the outbox (stamp Keycloak subject; flush/read filtered to current user) so passes can't be cross-credited on a shared browser.

Note on server config: the frontend window is bounded by the Keycloak realm's SSO Session Idle / Access Token Lifespan. Current realm values (SSO Session Idle 30 min, Access Token Lifespan ~5 min) already satisfy the needed invariant; bumping SSO Session Idle to 60 min is an optional headroom tweak. No realm change is required for this fix.

(Tangential: PR #30 also de-flaked the jsdom localStorage test harness uncovered while validating this work.)

Resolved in spikersoft-angular PR #29 (merged). **Root cause (two compounding bugs):** 1. *Aggressive idle logout* — keycloak-angular auto-refresh was set to a 5-min inactivity window with `onInactivityTimeout: "logout"`, so an idle user was hard-logged-out instead of silently refreshed (~5 min idle + remaining access-token lifespan ≈ the ~10 min reported). 2. *Non-durable local passes* — server-graded challenges and tutorials persist to Mongo synchronously, but browser-graded lessons (C#/Python/JS WASM) only became durable after the offline outbox flushed to `/Lessons/progress/batch`. If the forced logout fired first, the pass was stranded and re-login showed it incomplete. **Fix shipped:** - Session: `sessionTimeout` 5→30 min and `onInactivityTimeout` `logout`→`login` (silent re-auth via check-sso). - Durability: flush the outbox on `pagehide` / `visibilitychange` (hidden) and before manual logout. - Integrity: user-scope the outbox (stamp Keycloak subject; flush/read filtered to current user) so passes can't be cross-credited on a shared browser. **Note on server config:** the frontend window is bounded by the Keycloak realm's *SSO Session Idle* / *Access Token Lifespan*. Current realm values (SSO Session Idle 30 min, Access Token Lifespan ~5 min) already satisfy the needed invariant; bumping SSO Session Idle to 60 min is an optional headroom tweak. No realm change is required for this fix. (Tangential: PR #30 also de-flaked the jsdom `localStorage` test harness uncovered while validating this work.)

spikerj closed this issue

2026-06-09 15:44:55 +00:00

spikerj referenced this issue

2026-06-14 01:00:44 +00:00

[Bug] Progress can be lost in "In-Browser Compile" mode after completing a lesson then hard-refreshing #223

spikerj referenced this issue

2026-07-12 03:52:00 +00:00

[Bug][Prod][Infra] DLL decompiler service is built but never deployed — uploads RPC-timeout (no consumer on decompile.dll.upload.requested) #496

spikerj referenced this issue

2026-07-17 05:17:34 +00:00

[Reader][Social] Backend: shared bookmarks, upvotes, and reading lists (opt-in, child-safe) #631

spikerj referenced this issue