Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

token_expires event not raised when mobile device is in deep throttle mode, which makes the refresh functionality fail #1149

Closed
marty30 opened this issue Oct 25, 2021 · 6 comments · May be fixed by #1151
Labels
bug For tagging faulty or unexpected behavior.

Comments

@marty30
Copy link

marty30 commented Oct 25, 2021

Describe the bug
When a mobile device is locked, the token_expires event is not raised. This causes the access token to expire without triggering a refresh to the OAuth server.

Stackblitz example
The sample app in itself will show the problematic behavior if you open the sample app on a phone where the device is locked. Note however that the refresh request fails instead of timing out. Once the refresh request fails once, the application just stops automatically refreshing (is this intentional, no retries if the user did not have an internet connection while the refresh triggers?)

To Reproduce
Steps to reproduce the behavior:

  1. Open your app that uses the angular-oauth2-oidc library for OAuth OIDC authentication with Chrome 88+
  2. Lock your phone for the duration of the access token lifetime
  3. Unlock your phone and interact with your application
  4. The access token that is used, has become invalid

Expected behavior
The access token to be refreshed after 75% of its lifetime

Environment:

Additional context
We think that the setInterval timer, that is used by rxjs's delay function, is silently cancelled or paused by Chrome while the phone is locked. It seems to have to do with https://developer.chrome.com/blog/timer-throttling-in-chrome-88/.

@jeroenheijmans jeroenheijmans added the bug For tagging faulty or unexpected behavior. label Oct 25, 2021
@marty30
Copy link
Author

marty30 commented Oct 26, 2021

I have worked on this problem for some time now. I implemented the refresh timer using web workers (https://www.npmjs.com/package/worker-timers), but sadly that did not resolve the situation.

@marty30
Copy link
Author

marty30 commented Oct 27, 2021

It is still a work in progress, but I forked the repo and added some possible fix in this branch: https://github.com/marty30/angular-oauth2-oidc/tree/1149_refresh_token_after_unlocking_device

@CedricHg
Copy link

CedricHg commented Nov 2, 2021

I have been bothered by this one as well, a fix would be nice 👍

@famaridon
Copy link

+1 we have the same issue

@manfredsteyer
Copy link
Owner

Thanks @marty30 for this. So your solution is to do an additional check when the window gets the focus, right?

@marty30
Copy link
Author

marty30 commented Mar 15, 2023

That is correct. Just an additional check on focus. I hope that my PR is still mergable.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug For tagging faulty or unexpected behavior.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants