Adminhtml expired session auto-merge

Question

When managing multiple adminhtml tabs in a browser, idling for too long will result in being logged out. Consider a scenario where you have two tabs open, conveniently labeled tab 1 and tab 2, both currently active in the Magento backend.

After about 10 minutes of idling or so, you return to tab 1 and navigate using the menu. When the page reloads, you have been logged out for being inactive for too long, and you once again log in.

If you switch over to tab 2 now, and try navigate anywhere, instead of being logged out (because you have a new session) you are simply redirected to the dashboard.

Is there any way to prevent the dashboard redirection & continue regular navigation?

In other words, Magento knows that you're using the same browser (otherwise it would have logged you out) but it doesn't quite know how to handle your two different sessions, so it throws you to the dashboard and puts you on the now currently active session.

Answer 1

When you relogin and get a new session you also get a new session key (the one used in the admin urls key/asdhiuaysdk and when posting a form).
Magento uses this key to prevent CSRF attacks.
So here is what happens in your case.
You load tab 1 and tab 2 and you have a session key.
Your session expires, you login on tab 1. So you get a new session key,
You try to do some action on tab2. this action you perform sends the old session key.
Magento checks your old key against the new one and they don't match.
You get redirected to the dashboard.

There can be a solution to your problem but it works only for GET requests and I do not recommend it because it introduces a security risk.
You can disable the session keys from the url (System->Configuration->Admin).
This way, when you click on something in tab2 the session key is not validated anymore and you get the right page.
But this won't work if you perform a POST request on tab2. The session key is always checked for POST requests.