mteehan/vacuum-wall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: check tryRefreshToken result in WS reconnect, clear permissions on logout

Browse Source 
The token refresh callback in websocket.js ignored its ok parameter, causing
an infinite reconnect loop when the server rejected the refresh attempt. On
failure, redirect to login instead of reconnecting with a cleared token.

clearAuthTokens() now also removes vw:permissions from sessionStorage to
prevent stale permissions from persisting across logout/login cycles. Also
removed duplicate vw:user removeItem call.
This commit is contained in:
Mike Teehan
2026-07-28 02:44:09 +00:00
parent c4a10c7129
commit d52a0fad12
2 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
webui/static/hoover/api.js
+1 -1
View File
@@ -47,7 +47,7 @@ function clearAuthTokens() {
sessionStorage.removeItem('vw:access_ttl');
sessionStorage.removeItem('vw:session_id');
sessionStorage.removeItem('vw:user');
sessionStorage.removeItem('vw:user');
sessionStorage.removeItem('vw:permissions');
if (typeof window.__authRefreshTimer__ !== 'undefined') {
clearTimeout(window.__authRefreshTimer__);
window.__authRefreshTimer__ = undefined;