Google, Facebook, Twitter, Amazon, and Stack Overflow, among many others, use form submits with full page reloads instead of AJAX on their login forms. I saw this question (When should I use AJAX to submit forms VS regular page submit) which says that AJAX should always be preferred if you can convey the various form states to the user, so I'm curious why these major websites seem to be going against this. Is there a UX principle behind this or is it most likely a technical reason?
-
3this is not a great answer, but speaking as a developer, there'd be two factors: more steps required to secure an ajax login and you're often going to a completely different area of a site once logged in and/or seeing a drastic update to the UI. this is easier with a page reload.– user5482Oct 29, 2015 at 19:26
-
2An HTML form can be submitted across domain names (such as from YouTube.com to account.google.com) where an AJAX request cannot be. This isn't a factor for all websites, but if a site has a centralized login server for multiple sites, Ajax may not be possible.– CosmicOct 29, 2015 at 22:53
Add a comment
|
2 Answers
I've done it that way myself. My reasons were:
If the login form had been just another view, then considerable information about how the app worked would be downloaded to the browser prior to log-in, making it visible to potential hackers. (Security was a major concern.)
The security framework I was using had a convenient way to process login requests being sent to the server as normal form submits. Doing it within the app would have been more work, and any bugs in that work might be security holes. Related functions were also easier, like redirecting non-logged-in users to the login page.
Even in a other frameworks, the usual pattern is to treat "is the user already logged in" and "is this a submit of a login form" as security checks that happen before any application code is executed.
TL;DR: Layered software architecture and security boundaries.
Is there a UX principle behind this or is it most likely a technical reason?
Neither. Sometimes security takes precedence over usability. As a related example, the process once the user clicks the login button might be deliberately designed to be slow, to thwart people trying lots of passwords. (To be precise, the password is stored in such a way that the fastest algorithm to verify it takes that long.) You'll be tempted to ask if it can be any faster. The security expert will turn that around and ask you how long a delay the user can tolerate.
I'd argue that there are UX reasons to favor a page reload for logins:
The page reload generally gives a better indication that the input has been received and processed.
This is true for any input, of course, but logins are more sensitive to confusion in this regard, since:
- it's a lot easier than usual to make typing mistakes (in the typing of the password)
- and mistakes have a drastic, immediate, annoying outcome: the inability to authenticate and the necessity to input again the entire password.
So I'd be very careful before using ajax for logins (I put some ideas to do it sanely here ).
