Duplicate action execution: API calls and UI button clicks processed multiple times #5555

New Issue

OVERLORD · 2026-02-05T10:10:07+03:00

OVERLORD commented

2026-02-05 10:10:07 +03:00

Originally created by @AryeComb on GitHub (Dec 24, 2025).

Describe the Bug

BookStack appears to be executing actions multiple times when they should only execute once. This has been observed in two distinct scenarios:

API scenario: A single API call to create a page was executed 72 times, resulting in 72 duplicate pages being created
UI scenario: Clicking the "Save" button on a comment form multiple times (while waiting for feedback) resulted in 30 duplicate comments being created, which exceeded the actual number of button clicks

In both cases, there was no visual indication that the action was being processed, leading to multiple attempts/clicks, but the system appears to be queuing and executing all attempts rather than debouncing or preventing duplicates.

Steps to Reproduce

I'm not sure it's as easy to reproduce, so I'll provide more context in the hope you'll be able to reproduce that:

In the API I was using MCP with claude desktop, this was the only instance in which this happens (so around once per 100 api calls)
In the comments, it was during testing the comments system, espaecially the notification, so, we tested some corner cases (the bug didin't apear during the stress testing) but, for example, the admin try to edit a comment while the original comment creator deleted that comment, and then tried to create a new one, etc.

Expected Behaviour

Each API call should execute exactly once, even if the request appears to hang
UI buttons should be disabled or show loading state immediately after first click to prevent duplicate submissions
Duplicate actions should be prevented through request deduplication/idempotency checks
If a request is already in progress, subsequent attempts should either be ignored or queued with duplicate detection

Screenshots or Additional Context

No response

Browser Details

Chrome on WIndows 11

Exact BookStack Version

hm.. I think it was one of the latest, I'll check later and update this section

Originally created by @AryeComb on GitHub (Dec 24, 2025). ### Describe the Bug BookStack appears to be executing actions multiple times when they should only execute once. This has been observed in two distinct scenarios: 1. API scenario: A single API call to create a page was executed 72 times, resulting in 72 duplicate pages being created 2. UI scenario: Clicking the "Save" button on a comment form multiple times (while waiting for feedback) resulted in 30 duplicate comments being created, which exceeded the actual number of button clicks In both cases, there was no visual indication that the action was being processed, leading to multiple attempts/clicks, but the system appears to be queuing and executing all attempts rather than debouncing or preventing duplicates. ### Steps to Reproduce I'm not sure it's as easy to reproduce, so I'll provide more context in the hope you'll be able to reproduce that: 1. In the API I was using MCP with claude desktop, this was the only instance in which this happens (so around once per 100 api calls) 2. In the comments, it was during testing the comments system, espaecially the notification, so, we tested some corner cases (the bug didin't apear during the stress testing) but, for example, the admin try to edit a comment while the original comment creator deleted that comment, and then tried to create a new one, etc. ### Expected Behaviour - Each API call should execute exactly once, even if the request appears to hang - UI buttons should be disabled or show loading state immediately after first click to prevent duplicate submissions - Duplicate actions should be prevented through request deduplication/idempotency checks - If a request is already in progress, subsequent attempts should either be ignored or queued with duplicate detection ### Screenshots or Additional Context _No response_ ### Browser Details Chrome on WIndows 11 ### Exact BookStack Version hm.. I think it was one of the latest, I'll check later and update this section

OVERLORD added the 🐛 Bug label 2026-02-05 10:10:07 +03:00

OVERLORD commented

2026-02-05 10:10:09 +03:00

@ssddanbrown commented on GitHub (Dec 25, 2025):

Thanks @AryeComb for reporting, although I'd see this being a duplicate of prior issue #2661, with my thoughts being much the same, in that I'm not sure this is reported to be enough of an issue to address in all locations for UI forms.

When it comes to the API, I'd say that's expected, and it's down to the client in regards to how things behave. While it would be possible to add some kind of token system to avoid that, It would require the client to specifically handle/use that anyway, and I don't think it'd be worthwhile.

If there are particular pain points, especially for UI AJAX scenarios which do not have loading states, I'd be happy to consider those specifically. Are you okay for me to update this to focus on ensuring loading states for comment creation?

@ssddanbrown commented on GitHub (Dec 25, 2025): Thanks @AryeComb for reporting, although I'd see this being a duplicate of prior issue #2661, with my thoughts being much the same, in that I'm not sure this is reported to be enough of an issue to address in all locations for UI forms. When it comes to the API, I'd say that's expected, and it's down to the client in regards to how things behave. While it would be possible to add some kind of token system to avoid that, It would require the client to specifically handle/use that anyway, and I don't think it'd be worthwhile. If there are particular pain points, especially for UI AJAX scenarios which do not have loading states, I'd be happy to consider those specifically. Are you okay for me to update this to focus on ensuring loading states for comment creation?

OVERLORD commented

2026-02-05 10:10:10 +03:00

@AryeComb commented on GitHub (Dec 25, 2025):

Yes of course

@AryeComb commented on GitHub (Dec 25, 2025): Yes of course

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#5555