Sign in again through a front-door proxy when its session ends

jcoffey-dev commented

2026-10-10 00:33:27 +00:00

Owner

Fixes #47. Thanks @dwofford, the diagnosis was right on.

When an API call fails the way a proxy redirect does, the app checks whether the proxy is asking for a sign-in and, if so, opens the root for real so the proxy can show its login. I reproduced it locally with a fake Access-style proxy and a service-worker-controlled tab: main stays stuck on the cached sign-in page, this sends you to the proxy's login. Still worth a try on a real iPhone home-screen app.

Fixes #47. Thanks @dwofford, the diagnosis was right on. When an API call fails the way a proxy redirect does, the app checks whether the proxy is asking for a sign-in and, if so, opens the root for real so the proxy can show its login. I reproduced it locally with a fake Access-style proxy and a service-worker-controlled tab: main stays stuck on the cached sign-in page, this sends you to the proxy's login. Still worth a try on a real iPhone home-screen app.

jcoffey-dev added 1 commit 2026-10-10 00:33:27 +00:00

Sign in again through a front-door proxy when its session ends

ci / node (pull_request) Skipped

Details

ci / version (pull_request) Skipped

Details

ci / docker-build (pull_request) Skipped

Details

ci / publish (pull_request) Skipped

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 2m25s

Details

18a661144e

Behind Cloudflare Access or a similar proxy, an expired proxy session
answers every API call with a redirect to the proxy's login on another
origin. A fetch can't follow that, so it failed as a network error, and
an installed app never got out of it: it opens on an app route the
service worker serves from its kept copy, so nothing navigated to the
network for the proxy to catch (#47).

When an API call fails at the network, or comes back redirected to a
page that isn't ours, the app now asks /api/health without following
redirects. A redirect or an HTML answer means the proxy is asking, and
the root is opened for real, which the service worker always sends to
the network. At most once a minute, so a misconfigured proxy can't loop.

Fixes #47

jcoffey-dev referenced this issue from a commit

2026-10-10 00:34:19 +00:00

Sign in again through a front-door proxy when its session ends

jcoffey-dev referenced this pull request from inbuxa/inbuxa-webmail

2026-10-10 00:34:25 +00:00

Sign in again through a front-door proxy when its session ends #63

jcoffey-dev merged commit c02caac86e into main

2026-10-10 01:41:15 +00:00

jcoffey-dev deleted branch fix/proxy-reauth

2026-10-10 01:41:15 +00:00

jcoffey-dev referenced this pull request

2026-10-10 01:41:37 +00:00

Installed PWA can never sign in again after a front-door auth proxy (Cloudflare Access) session expires: "Network error" #47

Sign in again through a front-door proxy when its session ends #52