[kccqzy]

It’s really common for people to accidentally click a button twice. Yeah that’s what denouncing is for.

My favorite example of doing it wrong is a log in form: if the login button is clicked twice, the server would reject the login because the first click has already used up the one-time token so the user gets an error page.

But I think the biggest problem is that people either apply denouncing to all buttons in a UI (like turning it on within the framework they are using) or apply denouncing to nothing. So there really isn’t a culture for carefully considering which situations warrant which.

[PunchyHamster]

the correct action is not to debounce but instead of error page see user already logged in in previous request and continue

[jonahx]

I think the better solution for a web page login form specifically is to disable the button "onPressDown", so this error path is impossible.

For users with JS disabled, your solution seems good.

[stavros]

The correct action is to disable the button while the request is in flight so it can't be clicked a second time. Otherwise you won't see "user already logged in", because the user won't be logged in until the previous request returns (a race condition).

[LordDragonfang]

If you have a race condition, "correct action" is to solve that, because you shouldn't be papering over server-side bugs with client-side Javascript (and yes, it's a bug, because I shouldn't see an error page if I press the back button after logging in (and trying to navigate to what I was doing before logging in) either, which I still see quite often)

[stavros]

How would you solve this on the server?