Skip to content

Improve access token refresh handling during network interruption#2129

Draft
Cassolette wants to merge 3 commits intoopencloud-eu:mainfrom
Cassolette:patch/fix-reauth-network-interruption
Draft

Improve access token refresh handling during network interruption#2129
Cassolette wants to merge 3 commits intoopencloud-eu:mainfrom
Cassolette:patch/fix-reauth-network-interruption

Conversation

@Cassolette
Copy link

@Cassolette Cassolette commented Mar 11, 2026

Description

PR addresses two points;

  1. fix: let IDP decide auth workflow on access token renew failure
    6e61149 introduced handling in case of expired access tokens. It logs the user out forcefully as a fallback to avoid leaving the web UI in an unusable state. This fallback scenario can happen more frequently than expected as per linked issue, affecting the UX by requiring frequent credential keying. The fix is to not force a logout at the idp, but rather delegate the auth workflow over to the idp which will accurately determine the next step (re-authenticating if the session is still valid).
  2. fix: make better attempts at access token refresh while offline
    Make better efforts to allow successful silent signin during network downtime, reducing the occurrence of interruption in the UI or lost progress. We do this by retrying the silent sign in for 20 seconds if it fails due to a probable network error. It's not a bulletproof fix, and definitely does not cover all edge cases.

Related Issue

How Has This Been Tested?

  • manual

Types of changes

  • Bugfix
  • Enhancement (a change that doesn't break existing code or deployments)
  • Breaking change (a modification that affects current functionality)
  • Technical debt (addressing code that needs refactoring or improvements)
  • Tests (adding or improving tests)
  • Documentation (updates or additions to documentation)
  • Maintenance (like dependency updates or tooling adjustments)

@Cassolette
Copy link
Author

Cassolette commented Mar 11, 2026

Not sure that I like brute forcing signinSilent() and relying on undocumented behavior that's browser specific. I put it in as a POC. Can't think of any other good alternatives... 😮‍💨I'll gladly take it out if needed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Expired access tokens are not renewed when network is offline

1 participant