Make message on missing decryption key configurable
The problem
Our PrivateBin installation sits behind a third-party login flow (think Okta or Google or something like that) which loses the fragment ID on the way through, meaning that the first time you click on a link to a paste you end up on a page with the following message:
Clicking on the link again works, but users don't know to do this and end up thinking the paste is corrupted or something else in the system isn't working as expected. I don't know how often the problem might be a redirector or an URL shortener in general, but in our case at least it's basically always because of the login flow, and the message users get today doesn't help them understand what to do about it.
The solution
I think it'd be sufficient to make the message a little more actionable and user-friendly. Some possible ideas:
- Can we detect if the user just logged in, and make a more specific message in this case?
- Do we need a more specific message in this case or could we change the general message to mention fresh logins?
- Could we make this message actionable by adding a suggestion to try again?
- Or maybe make it configurable, if most installations won't have the login problem and it's just us?
Alternatives
It'd be delightful if we could preserve the fragment through the login flow somehow avoiding the whole problem but I imagine this might be much harder. Put it in a cookie or other local storage perhaps? I have no idea what the security implications of that idea might be tho.
Source: PrivateBin/PrivateBin