fix: prevent 401 errors on authenticated media after service worker restart#516
Merged
7w1 merged 3 commits intoSableClient:devfrom Mar 25, 2026
Merged
fix: prevent 401 errors on authenticated media after service worker restart#5167w1 merged 3 commits intoSableClient:devfrom
7w1 merged 3 commits intoSableClient:devfrom
Conversation
Three changes to src/sw.ts: 1. Fix early-return bug in fetch handler: when sessions.get(clientId) returns a session but validMediaRequest(url, session.baseUrl) fails (e.g. multi-account users on different homeservers, or URL format mismatch), the old code returned without calling event.respondWith(), causing the browser to make an unauthenticated request → 401. Now we only short-circuit if BOTH conditions are met. 2. Proactively broadcast requestSession to all window clients in the activate event. After a SW restart the sessions Map is empty; the old code relied on the first intercepted media fetch to trigger requestSessionWithTimeout. Now the SW pre-populates the Map right after claiming clients, eliminating the 3-second race window. 3. Add loadPersistedSession() as a final fallback in the fetch handler. If requestSessionWithTimeout returns nothing ( Three changes to src/sw.ts: 1. Fix early-return bug in fetch handler: when sessions.get(clientId) returns a session buo a 1. Fix early-return bug i
On SW restart the in-memory sessions Map is empty. Previously the fetch handler fell through to requestSessionWithTimeout (3 s race window), so all simultaneous thumbnail loads during that window 401'd. Changes: - Populate preloadedSession from Cache Storage in the activate handler so media fetches get immediate auth before the first live setSession arrives from the page. - Include preloadedSession in the byBaseUrl fast path so the synchronous branch handles the burst of thumbnail requests without waiting at all. - Clear preloadedSession as soon as any real setSession arrives so stale tokens cannot linger. - Handle empty clientId (uncontrolled-context fetches) by falling through to byBaseUrl / preloadedSession / loadPersistedSession instead of doing a bare return that bypassed respondWith and caused an unauthenticated request.
Contributor
Author
|
Edit: Actually, I think the messages are just rendering out of order (which I don't think is related to this PR) - Clicking on a message notification brings me to the message, at the top of the synced message group. Should be fixed by 1. in #529 |
7w1
approved these changes
Mar 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The service worker (SW) loses its in-memory session on restart (e.g. after the browser kills the SW background process). Any authenticated media request arriving before the SW re-reads session data from cache was returning a 401.
Two fixes:
activate: the SW now reads session data from the cache during theactivateevent, so it is available immediately when the firstfetchevent fires.Authorizationheader (previously an empty/invalid token was injected, causing the 401).Fixes #
Type of change
Checklist:
AI disclosure:
Attempts to resolve issues with the service worker not properly storing and/or refreshing media auth tokens on load. The changes mainly serve to ensure that a session is persisted during restarts (and then drop the persisted session once a live one is available). Also helps with refreshing tokens (
sw.tsln 651-661)