-
Notifications
You must be signed in to change notification settings - Fork 71
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
automaticSilentRenew with stored data creates two Auth instances #390
Comments
Does not happen in my application. Please enable debug log and verify where the problem comes from. |
@pamapa Will check, thanks. P.S. Could it be because of React 18 having Strict mode on in development? I see this change hitting a lot of people these days :) |
Maybe. I just saw this MR auth0/auth0-react#355, i guess we need the same, could that be your problem? |
Can confirm, happens for us using React 17. On a new page, silent renew is singular. After refreshing, it's duplicated. New page:
(note the timer at the end proceeding as normal) Refreshed page:
(note duplicated timer at the end) |
Did you find a solution for this problem? |
I've also encountered a duplicate authentication issue. It transformed into a race condition where authentication was called in an infinite loop and my laptop would shut down into protection mode. The only thing that worked for me was to set "silent_redirect_uri" to an empty string (because it would take the same value from redirect_uri) or to block self-frame through CSP so silent redirect wouldn't activate but that was an extreme method found by mistake :)). The only problem is that the silent authentication doesn't work anymore since I don't have the silent redirect link. |
This issue (question) staled some time ago, closing it for now. |
Here is the scenario:
Now, since the
automaticSilentRenew
istrue
by default, the OIDC will try to renew the token automatically. The problem is that it tries to do that TWICE, for some odd reason.And both of the times, it sends same payload. So, the first request passes, but second one always fails, since the refresh token is obsolete now.
But, disabling the
automaticSilentRenew
and doing it manually works just fine:This way only one refresh request gets called per application.
This issue doesn't appear if user closes the browser (session storage gets destroyed), and reopens it.
The text was updated successfully, but these errors were encountered: