mirror of
https://github.com/go-vikunja/vikunja.git
synced 2026-08-24 19:50:09 -05:00
The desktop branch of doRefresh() returned before the Web Locks section, so the main window and the quick entry window could both POST the same single-use OAuth refresh token on startup. The server rotates it on first use, so the losing window got a 401 and logged the user out. Move the desktop branch inside the lock and adopt the JWT another window already fetched when the stored refresh token changed while queued. Fixes https://github.com/go-vikunja/vikunja/issues/3275