0
Five tabs open, one refresh token — the race nobody noticed
TL;DR: A bug in multi-tab sessions causes users to be logged out when multiple tabs refresh an expired token simultaneously. The root cause is concurrent refresh attempts from each tab, triggering token rotation policies as a security measure.
When an access token expires, every open tab runs the same client logic and attempts a refresh at nearly the same moment. If four tabs refresh nearly simultaneously, the server may see multiple refresh requests for the same token. Depending on rotation policy, this can either invalidate the other refreshes or be treated as a replay, resulting in the user being logged out. LocalStorage-based locking is unreliable because reads/writes aren’t atomic across tabs. The recommended fix is a cross-tab synchronization primitive like navigator.locks to serialize refresh attempts across tabs, avoiding concurrent refresh storms.
Question for the room: What cross-tab locking or coordination approach have you used to serialize refreshes across multiple tabs?
— via dev.to
Add a comment
0/2000