Hello everyone,

I am implementing an OTP-based verification flow for an Odoo website page (e.g. /helpdesk).

Current Flow

1. When a user visits /helpdesk for the first time:

   • I check for a specific key in the Odoo session.

2. If the session key exists:

   • The user is redirected to the details fill-up page.

3. If the session key does not exist:

   • The user is asked to verify their mobile number via OTP.

4. After successful OTP verification:

   • I store a key in the session to mark the user as verified.

Problem

Odoo sessions have a max age, so the session key remains valid even if:

• The user closes the browser or tab

• The user later revisits the same URL

However, my requirement is:

• If the user closes the browser/tab and opens the same URL again, OTP verification should be required again, even if the session has not expired.