web/flows: prevent leader tab deadlock in continuous login flow#21482
Closed
ryanpesek wants to merge 2 commits intogoauthentik:version-2025.12from
Closed
web/flows: prevent leader tab deadlock in continuous login flow#21482ryanpesek wants to merge 2 commits intogoauthentik:version-2025.12from
ryanpesek wants to merge 2 commits intogoauthentik:version-2025.12from
Conversation
✅ Deploy Preview for authentik-integrations ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for authentik-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## version-2025.12 #21482 +/- ##
===================================================
+ Coverage 93.01% 93.28% +0.26%
===================================================
Files 947 947
Lines 52865 52865
===================================================
+ Hits 49175 49314 +139
+ Misses 3690 3551 -139
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
Contributor
Author
|
Closing this in favor of #21583 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Details
When the flowsContinuousLogin flag is enabled, the leader tab (the one completing login) discovers other open tabs via BroadcastChannel, tells them to continue, and waits for each to confirm exit before proceeding. Two issues could cause the leader to hang indefinitely:
Flag guard on responder side: multiTabOrchestrateLeave() checked flowsContinuousLogin before sending the exit broadcast. Tabs that loaded before the flag was enabled (or before a deploy with updated code) would receive the continue signal and navigate away successfully, but never send the exit confirmation—leaving the leader stuck in an infinite polling loop with localStorage lock never cleaned up. Removed the flag guard from multiTabOrchestrateLeave(); the flag check in multiTabOrchestrateResume() on the leader side is sufficient to gate the feature.
No timeout for unresponsive tabs: Tabs old enough to predate the flag guard fix, or those that crash/close during orchestration, would never send an exit message. Added a 3-second per-tab timeout so the leader logs a warning and moves on rather than waiting forever.
Additionally, added a pagehide event listener in Broadcast that automatically sends the exit message when a page unloads. This provides defense-in-depth for any edge case where a tab navigates away without explicitly calling multiTabOrchestrateLeave().
Checklist
ak test authentik/)make lint-fix)If an API change has been made
make gen)If changes to the frontend have been made
make web)If applicable
make docs)