My Account logout after inactivity

[Xplorer]

My Account gives the impression that you have been logged out if there is a period of inactivity, but all is not what it seems.

Following inactivity, a popup appears stating "Your session is about to expire. You will be logged out of your account in 120 seconds." After the 120 second countdown, the next popup states "Your session has expired. You've been logged out of your account due to inactivity.", and there is a 'Log back in' button.

However, simply refreshing the page allows continued access to the account, i.e. it is not logged out.

Clicking on the 'Log back in' button takes you to the login page, but you can return to the previously logged in account simply by using the browser back button. Alternatively, entering valid login credentials results in the previously logged in account appearing, even if the credentials are for a different account.

It would appear that whoever is responsible for the code did not test it properly.

[damianjk]

very interesting, I also get the 120 second popup even if I've not been on the page for a while. Sometimes I can refresh and continue and other times the session ID is invalid and the only way I can then log in is by retyping Talktalk.co.uk as the URL

It would appear that once you have logged in and got a session ID that the session sticks to the original logged in account even if you enter a completely different account to administer.

If true then this is a serious security issue.

My problem is that I have no access to bills. I'm able to login and make payments should I wish, but actually seeing/viewing/downloading/printing a bill doesn't work. TT are taking money out of my bank account and I have absolutely no idea if it's correct and no way of checking it, unless I pay £2.75 per bill for a paper copy. I was expecting a final bill 28th Oct, but no notification yet, I keep on looking, and the TT website sticks on 'loading' if I attempt to view any bill. The browser back button takes me to an 'unauthorised' page even though logged in correctly, so something seriously wrong with session ID's and credentials. I can only assume that TT have added marketing and tracking code to the website which has broken basic functionality. So yes, not tested properly, but very interesting to see your issues using valid and different account credentials, it simply shouldn't happen, it's the sort of thing that the ICO fine companies for.