Koha will log the staff user out if they refresh the homepage and confirm form resubmission after logging in with 2FA enforced. To reproduce: 1) ensure TwoFactorAuthentication is set to "Enforce" 2) log into staff interface including two factor code 3) refresh the homepage and confirm dialogue box for confirm form resubmission This logs you out. However if you navigate to another page and back a refresh functions normally; also if you don't have 2FA enabled a refresh functions normally. I've not submitted a bug before so please let me know if I've submitted this poorly/incorrectly.