Comment 5 for bug 510866

I've been checking through the excerpts from the Apache logs, and there are a fair number of cases where the /auth/complete URL is hit multiple times with the same OpenID response.

In these cases, the first request gets answered by a 302 response (a redirect back to whatever other page needed authentication), and the subsequent ones in a 403 respone (forbidden, presumably with the "Nonce already used or out of range" message).

So that leaves the question of why the user's machine is making multiple requests here.

To Mariano and Joe: when you were trying to log in, did anything weird happen during the process? Did any page take an unusually long time to load? Did you hit the reload button at any point?