Skip to content

Login fails when opening multiple tabs at once #16

Open
Open
Login fails when opening multiple tabs at once#16

Description

@alexgagnon
alexgagnon (alexgagnon)
opened on Dec 15, 2023

Please provide us with the following information:

This issue is for a: (mark with an x)

- [x] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Set your browser to open multiple tabs to localhost:3000/users/id on startup

Any log messages given by the failure

One tab will login, but the others will all show something like

invalid_grant: 501481 - [2023-12-15 16:48:51Z]: AADSTS501481: The Code_Verifier does not match the code_challenge supplied in the authorization request. Trace ID: *** Correlation ID: *** Timestamp: 2023-12-15 16:48:51Z - Correlation ID: *** - Trace ID: ***

Expected/desired behavior

All tabs should log in.

OS and Version?

Windows 10

Versions

@azure/msal-node": "^1.17.3

Mention any other details that might be useful

This seems to be due to how each request will start to initiate a login process, but since there is no session to share amongst the tabs the first tab to respond with the Set-Cookie header will force the others to then use the login codes associated to that tab instead of the ones they had used to initiate the call to login with MS.

Thanks! We'll be in touch soon.

Activity

  1. alexgagnon commented on Dec 18, 2023

    @alexgagnon
    alexgagnon (alexgagnon)
    on Dec 18, 2023
    Author

    I seem to be able to "solve" this by putting in a delay before routing to /signin. This causes all the tabs to resolve to a single session cookie before making the request to the login endpoint. Would this be considered a reasonable approach?

    async function isAuthenticated(req, res, next) {
    if (!req.session.isAuthenticated) {
        await new Promise(resolve => setTimeout(resolve, 2000))
        return res.redirect(`/auth/signin`);
    }

    next();
};

    NOTE: this doesn't work if in express-session you use resave: true

  2. alexgagnon commented on Dec 22, 2023

    @alexgagnon
    alexgagnon (alexgagnon)
    on Dec 22, 2023
    Author

    After investigating further, my solution above does not work at scale as when under load it causes a buildup of connections and degrades the server performance. So, is there a recommended strategy to resolve this?

  3. alexgagnon commented on Jan 8, 2024

    @alexgagnon
    alexgagnon (alexgagnon)
    on Jan 8, 2024
    Author

    Any suggestions on this?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions