search

orppst / pst-gui

web based front end for the tool
Mozilla Public License 2.0
0 stars 0 forks source link

authorisation token refresh causes UI refresh #24

Closed pahjbo closed 8 months ago

pahjbo commented 1 year ago

In an attempt to follow best practices most of the OIDC flow is done on the server side to avoid the possibility of leaking a refresh token, so that only relatively short lived access tokens are exposed in the client side javascript - The code to refresh these tokens is here - this does work for doing the refresh, but has two flaws

  1. the code is executing in a way that interacts with the react rendering that causes a page refresh - it needs to be more in the background...
  2. it will do a refresh even if the user is truly idle, which will greatly extend the session, potentially leaving an unattended browser "logged in"
DJWalker42 commented 1 year ago

Not sure if this is related but occasionally I get a '401' page not working error that I cannot get rid of, and which seems to occur on a token refresh but I am unable to confirm that. Quarkus restarts of both the api and gui do not clear the 401 neither does an invalidate cache and restart of IntelliJ. I have to wait for it to clear on its own and for unclear reasons.

alan-stokes commented 1 year ago

What i found when that occurred. Was that the 8080 port had been swiped by something. And the resetting was putting the ui on other random ports. But then the accessing the database would fail.

On Tue, 31 Oct 2023, 15:41 Darren Walker, @.***> wrote:

Not sure if this is related but occasionally I get a '401' page not working error that I cannot get rid of, and which seems to occur on a token refresh but I am unable to confirm that. Quarkus restarts of both the api and gui do not clear the 401 neither does an invalidate cache and restart of IntelliJ. I have to wait for it to clear on its own and for unclear reasons.

— Reply to this email directly, view it on GitHub https://github.com/orppst/pst-gui/issues/24#issuecomment-1787478658, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABZMFSGT5QX4B7R3UCJ66M3YCEL2NAVCNFSM6AAAAAA6XZ62WSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTOOBXGQ3TQNRVHA . You are receiving this because you are subscribed to this thread.Message ID: @.***>

alan-stokes commented 1 year ago

this may also be part of the authentication issues:

`Uncaught DOMException: Failed to execute 'removeChild' on 'Node': The node to be removed is not a child of this node. at removeChildFromContainer (http://localhost:8080/pst/gui/node_modules/.vite/deps/chunk-3UGZQCS3.js?v=2c36d518:8473:23) at commitDeletionEffectsOnFiber (http://localhost:8080/pst/gui/node_modules/.vite/deps/chunk-3UGZQCS3.js?v=2c36d518:17504:21) at recursivelyTraverseDeletionEffects (http://localhost:8080/pst/gui/node_modules/.vite/deps/chunk-3UGZQCS3.js?v=2c36d518:17482:13) at commitDeletionEffectsOnFiber (http://localhost:8080/pst/gui/node_modules/.vite/deps/chunk-3UGZQCS3.js?v=2c36d518:17573:15) at recursivelyTraverseDeletionEffects (http://localhost:8080/pst/gui/node_modules/.vite/deps/chunk-3UGZQCS3.js?v=2c36d518:17482:13) at commitDeletionEffectsOnFiber (http://localhost:8080/pst/gui/node_modules/.vite/deps/chunk-3UGZQCS3.js?v=2c36d518:17606:15) at recursivelyTraverseDeletionEffects (http://localhost:8080/pst/gui/node_modules/.vite/deps/chunk-3UGZQCS3.js?v=2c36d518:17482:13) at commitDeletionEffectsOnFiber (http://localhost:8080/pst/gui/node_modules/.vite/deps/chunk-3UGZQCS3.js?v=2c36d518:17573:15) at recursivelyTraverseDeletionEffects (http://localhost:8080/pst/gui/node_modules/.vite/deps/chunk-3UGZQCS3.js?v=2c36d518:17482:13) at commitDeletionEffectsOnFiber (http://localhost:8080/pst/gui/node_modules/.vite/deps/chunk-3UGZQCS3.js?v=2c36d518:17606:15) (anonymous) @ react-dom.development.js:22839 callCallback2 @ react-dom.development.js:4164 invokeGuardedCallbackDev @ react-dom.development.js:4213 invokeGuardedCallback @ react-dom.development.js:4277 reportUncaughtErrorInDEV @ react-dom.development.js:22838 captureCommitPhaseError @ react-dom.development.js:27126 recursivelyTraverseMutationEffects @ react-dom.development.js:24261 commitMutationEffectsOnFiber @ react-dom.development.js:24432 commitMutationEffects @ react-dom.development.js:24243 commitRootImpl @ react-dom.development.js:26810 commitRoot @ react-dom.development.js:26682 performSyncWorkOnRoot @ react-dom.development.js:26117 flushSyncCallbacks @ react-dom.development.js:12042 commitRootImpl @ react-dom.development.js:26959 commitRoot @ react-dom.development.js:26682 finishConcurrentRender @ react-dom.development.js:25981 performConcurrentWorkOnRoot @ react-dom.development.js:25809 workLoop @ scheduler.development.js:266 flushWork @ scheduler.development.js:239 performWorkUntilDeadline @ scheduler.development.js:533 Show 20 more frames Show less suppress-nextjs-warning.ts:6 The above error occurred in the component:

at AuthProvider (http://localhost:8080/pst/gui/src/auth/Auth.tsx?t=1699372136368:22:3)
at App2 (http://localhost:8080/pst/gui/src/App2.tsx?t=1699372564653:67:34)
at ModalsProvider (http://localhost:8080/pst/gui/node_modules/.vite/deps/@mantine_modals.js?v=2c36d518:228:27)
at MantineThemeProvider (http://localhost:8080/pst/gui/node_modules/.vite/deps/chunk-KS75JMCA.js?v=2c36d518:1919:3)
at MantineProvider (http://localhost:8080/pst/gui/node_modules/.vite/deps/chunk-KS75JMCA.js?v=2c36d518:2660:3)
at App

Consider adding an error boundary to your tree to customize error handling behavior. Visit https://reactjs.org/link/error-boundaries to learn more about error boundaries.`

found when moved away from the UI tab on the browser and then revisited about 3 mins later. It caused a refresh, and then a blank page, with the following error.

pahjbo commented 9 months ago

An alternative approach, rather than forcing an asynchronous token refresh in the background - which seems to cause all sorts of problems, is actually to refresh the token in every call to the server - this might seem wasteful, but it has a much clearer logic and means that the token lifetime is then naturally also an inactivity lifetime