Stay signed in through a network blip

jcoffey-dev commented

2026-10-18 22:31:43 +00:00

Owner

Any failed token refresh signed you out and reloaded the sign-in page. A
dropped connection, a server restart or a laptop waking up lost the page
and anything typed into it, and signing in again landed on the
dashboard.

Only a refusal ends the session: 400, 401 or 403 from the token
endpoint (our server answers a spent or revoked refresh token, or a
locked account, with 400 invalid_grant).
Anything else keeps you signed in on the page: no answer, a 5xx,
rate limiting, or a proxy's error page. A note at the top says the
server can't be reached. The refresh is retried after 5, 10 and 20
seconds, then every minute, at once when the browser comes back
online, and on "Try now".
A request whose token hasn't run out still goes ahead while the
refresh waits, and a refresh with no answer no longer surfaces as a
401.
Back where you were: when the session does end, signing in again
returns to the same page (kept in sessionStorage for the one trip,
since the way out is a full page load).

New: src/services/auth/session.ts, src/stores/connectionStore.ts,
src/components/layout/ConnectionBanner.tsx, with tests for each case
(12 of the 13 refresh/apiFetch tests fail against the old api.ts).

Typecheck, lint, i18n:check, all 684 tests, build and notice check pass
locally. 2 new strings, English only: connection.unreachable,
connection.retry.

Any failed token refresh signed you out and reloaded the sign-in page. A dropped connection, a server restart or a laptop waking up lost the page and anything typed into it, and signing in again landed on the dashboard. - **Only a refusal ends the session:** 400, 401 or 403 from the token endpoint (our server answers a spent or revoked refresh token, or a locked account, with 400 `invalid_grant`). - **Anything else keeps you signed in on the page:** no answer, a 5xx, rate limiting, or a proxy's error page. A note at the top says the server can't be reached. The refresh is retried after 5, 10 and 20 seconds, then every minute, at once when the browser comes back online, and on "Try now". - A request whose token hasn't run out still goes ahead while the refresh waits, and a refresh with no answer no longer surfaces as a 401. - **Back where you were:** when the session does end, signing in again returns to the same page (kept in sessionStorage for the one trip, since the way out is a full page load). New: `src/services/auth/session.ts`, `src/stores/connectionStore.ts`, `src/components/layout/ConnectionBanner.tsx`, with tests for each case (12 of the 13 refresh/apiFetch tests fail against the old `api.ts`). Typecheck, lint, i18n:check, all 684 tests, build and notice check pass locally. **2 new strings, English only:** `connection.unreachable`, `connection.retry`.

jcoffey-dev added 1 commit 2026-10-18 22:31:44 +00:00

Stay signed in through a network blip

ci / build (pull_request) Skipped

Details

ci / publish (pull_request) Skipped

Details

ci / notices (pull_request) Successful in 52s

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 1m51s

Details

eb901af98f

Any failed token refresh signed you out and reloaded the sign-in page: a
dropped connection, a server restart or a laptop waking up lost the page
and anything typed into it, and signing in again landed on the dashboard.

- Only a refusal from the token endpoint (400, 401, 403: the refresh
  token is spent or revoked, or the account locked) ends the session.
- No answer, a 5xx, rate limiting or a proxy's error page keeps you
  signed in on the page. A note says the server can't be reached; the
  refresh is retried after 5, 10 and 20 seconds, then every minute, at
  once when the browser comes back online, or on "Try now".
- A request with a token that hasn't run out still goes ahead while the
  refresh waits, and a failed refresh no longer reads as a 401.
- When the session does end, signing in again comes back to the page
  you were on.

2 new strings, English only.

jcoffey-dev merged commit f89b38a8c4 into main

2026-10-18 22:40:30 +00:00

jcoffey-dev deleted branch fix/keep-session-on-blip

2026-10-18 22:40:31 +00:00

Stay signed in through a network blip #114