Shares "only work 1 time"

[hugopvl]

Preflight Checklist

• I have completed all Troubleshooting Steps.
• I'm on the latest version of Directus.
• There's no other issue that already describes my problem.

Describe the Bug

if I open the link I share for the first time, it works perfectly, asks me for the password, and opens the content.

if I then close the browser and open the link again, it no longer works:

{
  "errors": [
    {
      "message": "You don't have permission to access this.",
      "extensions": {
        "code": "FORBIDDEN"
      }
    }
  ]
}

if I clear the browser history, it works again, but only one more time and the same happens again.

the same happens if you are viewing the content and refresh your browser:

{
  "errors": [
    {
      "message": "You don't have permission to access this.",
      "extensions": {
        "code": "FORBIDDEN"
      }
    }
  ]
}

To Reproduce

create a share, and open the link, refresh the browser, or close the browser and reopen the link.

Errors Shown

{
  "errors": [
    {
      "message": "You don't have permission to access this.",
      "extensions": {
        "code": "FORBIDDEN"
      }
    }
  ]
}

What version of Directus are you using?

9.4.2

What version of Node.js are you using?

16.13.0

What database are you using?

MSSQLSERVER

What browser are you using?

chrome, firefox, edge

What operating system are you using?

macos, windows

How are you deploying Directus?

locally, debian server.

[rijkvanzanten]

@licitdev Did I correctly hear you say you were able to reproduce this? I can't seem to reproduce this on my end 🤔 (in Postgres nor MS SQL).

[torstenhoegel]

I got the same error on a digitalocean provisioned PaaS versioned Directus Version with an SQLite DB. @rijkvanzanten

[licitdev]

@licitdev Did I correctly hear you say you were able to reproduce this? I can't seem to reproduce this on my end 🤔 (in Postgres nor MS SQL).

Yes, I was able to reproduce the issue in SQLite.

[turbolaserhawk]

I think I might be having the same issue. In my use case, I am sometimes seeing the shared content, and subsequently getting a permission denied, or alternately seeing null content (many different trial runs through this, experimenting). Form will display, but all content in forms is null. Playing with role permissions to attempt to resolve. Will watch for improvements in next release. Such an excellent feature!