From 2598e375bf2b323691a8f6fbc21cb31a5c33c504 Mon Sep 17 00:00:00 2001
From: Helmut Merz <helmutm@cy55.de>
Date: Wed, 11 Feb 2026 09:48:59 +0100
Subject: [PATCH] login: only try to login when not yet logged in; always set
 camefrom in request

---
 cco/member/auth.pt    | 1 +
 cco/member/browser.py | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/cco/member/auth.pt b/cco/member/auth.pt
index 315fe88..cab2890 100644
--- a/cco/member/auth.pt
+++ b/cco/member/auth.pt
@@ -6,6 +6,7 @@
              tal:define="principal request/principal/id;
                    baseUrl python:request.URL[-1];
 	   			   camefrom python:request.get('camefrom') or baseUrl;
+                   dummy python:request.form.setdefault('camefrom', baseUrl);
 				   dummy item/checkAuth">
     <p style="color: Red"
        tal:condition="request/error_message|nothing"
diff --git a/cco/member/browser.py b/cco/member/browser.py
index bb26ce0..6f2585d 100644
--- a/cco/member/browser.py
+++ b/cco/member/browser.py
@@ -62,12 +62,12 @@ def validateToken(token, secret=None):
 class LoginBase:
 
     def __call__(self):
-        if self.authMethod == 'oidc':
+        if self.isAnonymous and self.authMethod == 'oidc':
             return self.authOidc()
         return super(LoginBase, self).__call__()
 
     def checkAuth(self):
-        if self.authMethod == 'oidc':
+        if self.isAnonymous and self.authMethod == 'oidc':
             return self.authOidc()
 
     @Lazy