Repository navigation
Web: a single failed silent renew permanently kills the session — no retry, no signinSilent-on-401 #3165
Description
A transient network interruption (e.g., a VPN reconnect) at the moment silent renewal fires causes the web session to die permanently even though the IdP session remains valid.
Server logs show the tab's SSE stream auto-reconnecting with the expired access token (repeated 401s — failed to verify access token: token has invalid claims: token is expired — same request-id, over several minutes) with no renewal re-attempt, then the user is dropped to the "Not logged in" page. Clicking "Log in again" re-enters without a credential prompt — the IdP session was healthy throughout; only the client-side renewal path died.
Expected behavior: retry silent renewal with backoff on failure, and/or attempt signinSilent on the first 401 before surfacing the logout page.
Version: 7.3.0 (rolling). Standard WEB_OIDC_* config with offline_access scope and WEB_OIDC_SILENT_REDIRECT_URL wired.
Metadata
Metadata
Assignees
Type
Projects
- Status
Activity
el-drone commentedon Jul 24, 2026
Two additions from continued observation:
1. Wake-from-sleep is a systematic trigger, not just VPN blips. After a machine sleeps past token expiry, the renewal fires immediately on wake — racing network re-establishment — and loses; with no retry, the session is dead on arrival every morning. This makes the failure a daily occurrence for laptop users regardless of token lifespan (we raised ours 5m→30m; midday incidents dropped as expected, the on-wake case remains).
2. The dead client loops indefinitely. Once in this state, the SPA's SSE stream reconnects with the stale token on a ~40s cadence for as long as the tab stays open — we observed a single tab producing an ~80-minute continuous 401 stream server-side. So the missing renew-retry has a server-cost dimension too: a retry (or stopping the SSE reconnects once renewal is known-dead) would fix both.
JammingBen commentedon Jul 24, 2026
These issues are always hard to debug. The client definitely has an issue where it doesn't retry a token renewal when it considers the token is still valid, even though it's not. opencloud-eu/web#2951 fixes this (as well as adding a proper SSE connection close on user unload + a more generous retry-flow).
I need to do some further testing with it though. You could try it yourself if you have the chance to run a local setup (see the web dev docs on how to).
fix: retry silent token renewal before logout on auth error