Skip to content

Silent refresh with multiple tabs #762

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
eduardocalixtoviasoft opened this issue Mar 24, 2020 · 2 comments · May be fixed by #1423
Open

Silent refresh with multiple tabs #762

eduardocalixtoviasoft opened this issue Mar 24, 2020 · 2 comments · May be fixed by #1423
Labels
feature-request Improvements and additions to the library.

Comments

@eduardocalixtoviasoft
Copy link

eduardocalixtoviasoft commented Mar 24, 2020

The question
I currently having a problem using silent-refresh with multiple tabs and localStorage. As far as I know, the "bug" occurs due to nonce be shared between tabs, making all silent-refresh fail because of wrong nonce. Thus, should I change something in my code? My current probable solution is to set only nonce to be saved in sessionStorage, this way no conflict would happen between tabs.

image

To Reproduce
Steps to reproduce the behavior:

  1. Have an app with silentRefresh and set localStorage as oauth Storage
  2. Wait for silent-refresh request
  3. In Console, there will be a error due to wrong nonce

Desktop (please complete the following information):

  • OS: Windows
  • Browser Chrome
  • Version 80.0.3987.149

Edit 1
Forgot to say that I'm using angular-oauth2-oidc 8.0.2 version, not the latest (released this month)

@jeroenheijmans
Copy link
Collaborator

This is expected behavior currently I think. If your app shares login state between tabs via a certain OAuthStorage (e.g. localStorage), and multiple tabs start login at the same time, some of them will fail when they return and other tabs already updated things.

The options I can think of that you have:

  1. Just let it be. There's no effect for your users.
  2. Just let it be, but provide your own logger to the library's logging dependency, and filter out this stuff.
  3. Prevent your app from trying login on multiple tabs at the same time, by having some form of cross-tab communication.
  4. Switch to each tab using its own storage.

We could certainly leave this issue open, as it might make sense to have a Feature Request (?) open for the library to support option 3?

@jeroenheijmans jeroenheijmans added the feature-request Improvements and additions to the library. label Mar 28, 2020
@EraYaN
Copy link

EraYaN commented Jul 21, 2022

Authentication servers can decide to invalidate your grant when you reuse refresh tokens so this breaks them, because often if the refreshes are close enough they will result in token reuse (And thus cause a log out event).

EDIT: seems like what I meant is more like #850 or #1148

@chdanielmueller chdanielmueller linked a pull request Jul 18, 2024 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature-request Improvements and additions to the library.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants