github-starred/vikunja
2
0
Fork 0
mirror of https://github.com/go-vikunja/vikunja.git synced 2026-07-15 22:32:29 -05:00
Code Issues 690 Packages Projects Releases 11 Wiki Activity

[PR #2529] [MERGED] fix(auth): prevent automatic logout after a few minutes #10055

New Issue
Closed
opened 2026-04-23 09:22:29 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-23 09:22:29 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/go-vikunja/vikunja/pull/2529
Author: @tink-bot
Created: 4/2/2026
Status: ✅ Merged
Merged: 4/3/2026
Merged by: @kolaente

Base: main ← Head: fix-auto-logout

📝 Commits (2)

  • 882b21d fix(auth): normalize API base URL to prevent refresh cookie path mismatch
  • 3d04f69 fix(auth): add retry and logging for token refresh failures

📊 Changes

1 file changed (+24 additions, -7 deletions)

View changed files

📝 frontend/src/helpers/fetcher.ts (+24 -7)

📄 Description

Users are logged out after a few minutes despite checking "remember me". The root cause is that when API_URL lacks a trailing slash, axios resolves the refresh endpoint to a path that doesn't match the refresh token cookie's Path attribute, so the browser silently omits the HttpOnly cookie and token renewal fails.

Fixes #2391

This PR addresses the issue from multiple angles:

  • Normalize API_URL to always end with / so axios relative URL resolution matches the cookie path
  • Make OAuth2 desktop sessions long-lived — they were hardcoded as short sessions, expiring after 72h regardless of user intent
  • Replace localStorage.clear() with targeted key removal on logout so accidental logouts don't wipe user preferences
  • Add a single retry for transient refresh failures (network blips, server restarts)
  • Log refresh failures to console.warn for easier diagnosis

Test plan

  • Set API_URL without a trailing slash, login with "remember me", wait >10 minutes — should stay logged in
  • Desktop app: login via OAuth — session should persist beyond 72h

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/go-vikunja/vikunja/pull/2529 **Author:** [@tink-bot](https://github.com/tink-bot) **Created:** 4/2/2026 **Status:** ✅ Merged **Merged:** 4/3/2026 **Merged by:** [@kolaente](https://github.com/kolaente) **Base:** `main` ← **Head:** `fix-auto-logout` --- ### 📝 Commits (2) - [`882b21d`](https://github.com/go-vikunja/vikunja/commit/882b21dbb9edc2a689a0b3b08ba1dc6396996998) fix(auth): normalize API base URL to prevent refresh cookie path mismatch - [`3d04f69`](https://github.com/go-vikunja/vikunja/commit/3d04f697dd329d01a296a0ecaf70485e4c6cce45) fix(auth): add retry and logging for token refresh failures ### 📊 Changes **1 file changed** (+24 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `frontend/src/helpers/fetcher.ts` (+24 -7) </details> ### 📄 Description Users are logged out after a few minutes despite checking "remember me". The root cause is that when `API_URL` lacks a trailing slash, axios resolves the refresh endpoint to a path that doesn't match the refresh token cookie's `Path` attribute, so the browser silently omits the HttpOnly cookie and token renewal fails. Fixes #2391 This PR addresses the issue from multiple angles: - **Normalize `API_URL`** to always end with `/` so axios relative URL resolution matches the cookie path - **Make OAuth2 desktop sessions long-lived** — they were hardcoded as short sessions, expiring after 72h regardless of user intent - **Replace `localStorage.clear()` with targeted key removal** on logout so accidental logouts don't wipe user preferences - **Add a single retry** for transient refresh failures (network blips, server restarts) - **Log refresh failures** to `console.warn` for easier diagnosis ## Test plan - Set `API_URL` without a trailing slash, login with "remember me", wait >10 minutes — should stay logged in - Desktop app: login via OAuth — session should persist beyond 72h --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-23 09:22:29 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
area/attachments
area/auth
area/avatars
area/backup-restore
area/caldav
area/calendar-view
area/comments
area/config
area/database
area/desktop
area/docker
area/email
area/favorites
area/filters
area/frontend
area/gantt
area/i18n
area/import-export
area/internal-code
area/kanban
area/labels
area/list-view
area/mobile
area/notifications
area/permissions
area/projects
area/pwa
area/recurring-tasks
area/reminders
area/search
area/shortcuts
area/subtasks
area/sync
area/table-view
area/task-editor
area/task-metadata
area/task-relations
area/teams
area/theming
area/time-tracking
area/typesense
area/views
area/webhooks
bug
changes requested
concern/accessibility
concern/performance
concern/regression
concern/ux
confirmed
db/mysql
dependencies
enhancement
good first issue
help wanted
integration/inbound
integration/outbound
kind/bug
kind/feature
needs reproduction
pull-request
Mirrored from GitHub Pull Request
 question
security
support
upstream issue
waiting for reply
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vikunja#10055
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?