Fix/sw media auth - issues causing unauthenticated media requests#475
Open
Just-Insane wants to merge 3 commits intoSableClient:devfrom
Open
Fix/sw media auth - issues causing unauthenticated media requests#475Just-Insane wants to merge 3 commits intoSableClient:devfrom
Just-Insane wants to merge 3 commits intoSableClient:devfrom
Conversation
Three changes to src/sw.ts: 1. Fix early-return bug in fetch handler: when sessions.get(clientId) returns a session but validMediaRequest(url, session.baseUrl) fails (e.g. multi-account users on different homeservers, or URL format mismatch), the old code returned without calling event.respondWith(), causing the browser to make an unauthenticated request → 401. Now we only short-circuit if BOTH conditions are met. 2. Proactively broadcast requestSession to all window clients in the activate event. After a SW restart the sessions Map is empty; the old code relied on the first intercepted media fetch to trigger requestSessionWithTimeout. Now the SW pre-populates the Map right after claiming clients, eliminating the 3-second race window. 3. Add loadPersistedSession() as a final fallback in the fetch handler. If requestSessionWithTimeout returns nothing ( Three changes to src/sw.ts: 1. Fix early-return bug in fetch handler: when sessions.get(clientId) returns a session buo a 1. Fix early-return bug i
On SW restart the in-memory sessions Map is empty. Previously the fetch handler fell through to requestSessionWithTimeout (3 s race window), so all simultaneous thumbnail loads during that window 401'd. Changes: - Populate preloadedSession from Cache Storage in the activate handler so media fetches get immediate auth before the first live setSession arrives from the page. - Include preloadedSession in the byBaseUrl fast path so the synchronous branch handles the burst of thumbnail requests without waiting at all. - Clear preloadedSession as soon as any real setSession arrives so stale tokens cannot linger. - Handle empty clientId (uncontrolled-context fetches) by falling through to byBaseUrl / preloadedSession / loadPersistedSession instead of doing a bare return that bypassed respondWith and caused an unauthenticated request.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Appears to fix #358
Main issues:
clientIdbeing empty from clients such as prerenders which caused unauthenticated media requestsNote that you need to reload the SW by either killing the current one in DevTools, or if on mobile, the simplest option is to remove/re-download the PWA.
Type of change
Checklist:
AI disclosure:
These changes (2 commits) combine to reduce the likelihood that a missing/stale session will result in failed authenticated media requests that result in 401 errors by:
preloadedSessionin-memory fallback is discarded once a live session is received, though the underlying cache entry remains until logout.