AxaFrance / oidc-client

Light, Secure, Pure Javascript OIDC (Open ID Connect) Client. We provide also a REACT wrapper (compatible NextJS, etc.).
MIT License
582 stars 160 forks source link

When having more than two tabs opened, the OidcProvider stops producing events after 2 errors #1272

Closed dpcodes closed 8 months ago

dpcodes commented 8 months ago

Issue and Steps to Reproduce

Unrelated but the react demo is down

With service worker

Note that we are NOT using offline_access so no refresh tokens

We are currently encountering an issue where when you have more than 2 tabs opened, if 2 of them errors, the third tab stops emitting events.

We are using silent login with a SSOLifetime. When the SSO expires and the silent login tries to renew the tokens, it errors, requiring login. It's working as expected with 2 tabs.

When you have more than 2 tabs, the 3rd one isn't receiving anymore events (from onEvent in OidcProvider) once the first 2 have both received refreshTokensAsync_error.

This causes an issue because on the first 2 tabs we are seeing the SessionLost page as expected, but on the 3rd one, it stays inside the app but all the calls are returning 401.

To reproduce:

  1. Set UserSsoLifetime to 300 seconds (5 minutes)
  2. Set AccessTokenLifetime to 120 seconds (2 minutes)
  3. Wait for the silent login to try and fetch new tokens once the SSO has expired.
  4. First 2 tabs will receive errors, but the 3rd one will stop during the lock.

Versions

latest

Screenshots

image

Expected

The 3rd tab receives the errors allowing the SessionLost page to show

Actual

The 3rd tab doesn't receive the error, staying inside the app and all fetch calls are returning 401.

Additional Details

guillaume-chervet commented 8 months ago

Thank you @dpcodes for your issue. I am on it. It will help me a lot !

guillaume-chervet commented 8 months ago

hi @dpcodes which version are you using?

dpcodes commented 8 months ago

I tried with 7.13.14 and latest, and it was happening on both

dpcodes commented 8 months ago

Quick tests with 7.15.4-alpha.1309: the issue appears to be fixed.

Merci beaucoup Guillaume!

guillaume-chervet commented 8 months ago

Hi @dpcodes , you can use mainlatest version now.