Repository navigation
fix(solid): keep the stored session when a restore attempt is old - #674
Merged
Merged
Conversation
A load that found an unanswered silent restore attempt older than the restore deadline ended the stored session, on the reasoning that a working provider would have answered by then. A restore that ran out of time, or failed, ended it too. But another page can navigate the tab, keep it from leaving for the provider, and choose when it brings it back, so neither an attempt's age nor the deadline proves anything about the provider, and the learner could be logged out in every tab without any answer from it. Now only the provider's own refusal of the tab's request, which the sign-in client handles, ends the stored session on its own. An unanswered attempt of any age skips the silent restore and shows that the provider did not answer. A silent restore that runs out of time shows that it took too long and keeps the attempt, so the next load does not wait on the provider again; a login's answer that runs out of time keeps none. Both keep the stored session, for a later load to try again. So that a learner whose provider never answers is not stuck with it, the landing page that shows either error offers "Forget this session" while a session is stored. It ends the stored session without asking the provider and tells the other tabs, as a logout does. It takes a click on the app's own page. Refs: GHSA-73gp-72j2-85h8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
A load that found an unanswered silent restore attempt older than the restore deadline ended the stored session in every tab. So did a restore that ran out of time or failed. Another page can affect when a tab comes back and whether it leaves at all, so neither the attempt's age nor the deadline shows that the provider failed.
app.forgetSessionin all six locales.docs/authentication.mdanddocs/solid-memo-client.mddescribe the new rules and their cost: with a provider that never answers, a load waits up to the deadline until the learner logs in again or forgets the session.Refs: GHSA-73gp-72j2-85h8