Password login form allows duplicate submissions

[kazeruch]

Description

The password login form in the ondemand theme does not disable the
submit button after submission.

When the form is submitted more than once, the first request completes
successfully, but the second request reuses the consumed authentication
state and returns 400 Bad Request.

Environment

• ondemand-dex 2.45.1
• LDAP connector
• ondemand frontend theme

Observed behavior

The same login URL receives two POST requests:

1. The first POST succeeds and returns a redirect.
2. The second POST returns 400 with:

invalid 'state' parameter provided: not found

Expected behavior

The login button should be disabled after the first valid form
submission to prevent duplicate requests.

Upstream reference

Dex added duplicate-submit prevention to its default password template
in dexidp/dex#3554:

dexidp/dex@a1748467

The same protection does not appear to be present in:

https://github.com/OSC/ondemand-dex/blob/master/web/templates/password.html

[treydock]

@kazeruch I've copied that Dex commit's changes to #42 but I don't have a way to easily test as we don't deploy with Dex at OSC. If you have a dev or test OnDemand instance with Dex, could you copy the modified files from #42 to your dev or test host and verify the changes solve your issue? I can also release a pre-release staging RPM or .deb package if you would prefer to test with a patched package.