I'm working on a Single Sign On service.

An example use case I'm trying to solve is as follows:

  1. User A sends User B a link to www.exampleapp.com/resource/abc. This resource requires authentication to access it.
  2. User B clicks the link, and because they're not authenticated they're redirected to logon.example.com?authref=arefecodehere
  3. User B erroneously bookmarks this page - thinking it is a link to the resource.
  4. User B enters their credentials here, and are redirected back to the resource they were trying to access.
  5. The next day User B clicks the bookmark. (Current behaviour) the user can enter their credentials, and then receive an error page when they are successfully authenticated, but the authentication referral is expired.
  6. The user then complains to their colleagues/calls the service desk.

The question is - how should this scenario be handled?

I have a few ideas:

  • Add a message on the initial login 'don't bookmark this page.'
  • When the user returns to the bad bookmark, immediately display an error page. -- In which case - what should the message say? Does 'this URL is no longer valid' suffice?
  • Detect which application the referral code refers to, and immediately redirect them to that page.
  • Just log the user into their self service page (where they manage their credentials).

I'm of the opinion that we shouldn't design to explicitly correct the user's behavior. Instead you give them a closed door and let them try another way. But I'm wondering if that is in fact good design philosophy.

  • Unless I'm missing something, why would the referral code added to the login page expire? Is this not just "where they originally wanted to get to". The token/whatever granted after logging-in should expire, but I'm can't see why "where I wanted to be" should expire?
    – TripeHound
    Commented Mar 15, 2018 at 12:36

1 Answer 1


I think the answer lies between the two middle options you present. Answer two questions:

  1. What does the user want to do? They want to get to the resource. Are their credentials bad? No, because they get the error page after they successfully log in. I wouldn't penalize them.
  2. Are they using the app correctly? Nope: they bookmarked the wrong page, but it'll be alright as long as its easily rectified.

How about a 'were you trying to go to the resource?' link (detecting the app) and a notice that the URL is expired? Easy to get them on track, and not painful for the user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.