Sign in again through a front-door proxy when its session ends

jcoffey-dev commented

2026-10-10 00:34:25 +00:00

Owner

Same fix as coffey-labs/ihasmail#52 (for coffey-labs/ihasmail#47): when a sign-in proxy's session runs out, the app sends you to the proxy's login instead of failing with a network error.

jcoffey-dev added 1 commit 2026-10-10 00:34:25 +00:00

Sign in again through a front-door proxy when its session ends

ci / node (pull_request) Skipped

Details

ci / version (pull_request) Skipped

Details

ci / docker-build (pull_request) Skipped

Details

ci / publish (pull_request) Skipped

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 2m4s

Details

ci / announce (pull_request) Skipped

Details

4ad8ff050c

Behind Cloudflare Access or a similar proxy, an expired proxy session
answers every API call with a redirect to the proxy's login on another
origin. A fetch can't follow that, so it failed as a network error, and
an installed app never got out of it: it opens on an app route the
service worker serves from its kept copy, so nothing navigated to the
network for the proxy to catch (coffey-labs/ihasmail#47).

When an API call fails at the network, or comes back redirected to a
page that isn't ours, the app now asks /api/health without following
redirects. A redirect or an HTML answer means the proxy is asking, and
the root is opened for real, which the service worker always sends to
the network. At most once a minute, so a misconfigured proxy can't loop.

Port of coffey-labs/ihasmail#52, which fixes coffey-labs/ihasmail#47.

(cherry picked from commit 18a661144ed655412f52cd709e7d6530a8ebf994)

jcoffey-dev merged commit 0c22190f50 into main

2026-10-10 01:41:20 +00:00

jcoffey-dev deleted branch fix/proxy-reauth

2026-10-10 01:41:21 +00:00

Sign in again through a front-door proxy when its session ends #63