{"action":"created","issue":{"url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/861","repository_url":"https://api.github.com/repos/simplabs/ember-simple-auth","labels_url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/861/labels{/name}","comments_url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/861/comments","events_url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/861/events","html_url":"https://github.com/simplabs/ember-simple-auth/issues/861","id":127649627,"number":861,"title":"Refreshing and revoking token with often repeated requests can cause a 401 error","user":{"login":"Amareis","id":4806617,"avatar_url":"https://avatars.githubusercontent.com/u/4806617?v=3","gravatar_id":"","url":"https://api.github.com/users/Amareis","html_url":"https://github.com/Amareis","followers_url":"https://api.github.com/users/Amareis/followers","following_url":"https://api.github.com/users/Amareis/following{/other_user}","gists_url":"https://api.github.com/users/Amareis/gists{/gist_id}","starred_url":"https://api.github.com/users/Amareis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Amareis/subscriptions","organizations_url":"https://api.github.com/users/Amareis/orgs","repos_url":"https://api.github.com/users/Amareis/repos","events_url":"https://api.github.com/users/Amareis/events{/privacy}","received_events_url":"https://api.github.com/users/Amareis/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/simplabs/ember-simple-auth/labels/triage","name":"triage","color":"006b75"}],"state":"open","locked":false,"assignee":{"login":"atonse","id":6015,"avatar_url":"https://avatars.githubusercontent.com/u/6015?v=3","gravatar_id":"","url":"https://api.github.com/users/atonse","html_url":"https://github.com/atonse","followers_url":"https://api.github.com/users/atonse/followers","following_url":"https://api.github.com/users/atonse/following{/other_user}","gists_url":"https://api.github.com/users/atonse/gists{/gist_id}","starred_url":"https://api.github.com/users/atonse/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/atonse/subscriptions","organizations_url":"https://api.github.com/users/atonse/orgs","repos_url":"https://api.github.com/users/atonse/repos","events_url":"https://api.github.com/users/atonse/events{/privacy}","received_events_url":"https://api.github.com/users/atonse/received_events","type":"User","site_admin":false},"milestone":null,"comments":2,"created_at":"2016-01-20T10:17:17Z","updated_at":"2016-04-12T14:19:38Z","closed_at":null,"body":"So, problem in a nutshell:\r\n>[20/Jan/2016 09:50:44] \"POST /api/auth/revoke-token/ HTTP/1.1\" 200 0\r\n>[20/Jan/2016 09:50:44] \"POST /api/auth/revoke-token/ HTTP/1.1\" 200 0\r\n>[20/Jan/2016 09:50:44] \"GET /api/v1/disputes/9289bb5f-fd8b-4c56-a5db-bc95810e076e/ HTTP/1.1\" 401 59\r\n\r\nIf you do a lot of frequently repeated requests (for example, once per second, it does not really matter, because the problem will sometimes occur at any frequency), then immediately after the refresh or revoke token next request will sometimes use the old token and get a 401 error. It is not very scary, but I was confused by the red line in the console, so I did, um, a temporary solution aka crutch.\r\n\r\nMy custom authenticator:\r\n```coffescript\r\nsession: Ember.inject.service()\r\n\r\ninvalidate: (data) ->\r\n  @set('session.data.authenticated.access_token', '')\r\n  @_super(data)\r\n```\r\nThis code removes the problem of revocation a token, because the standard authorizer verifies that the token is not empty.\r\n\r\nFix refresh token is more difficult - I had to make a synchronous request to refresh, that suits me, but may be unacceptable for other users."},"comment":{"url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/comments/208929596","html_url":"https://github.com/simplabs/ember-simple-auth/issues/861#issuecomment-208929596","issue_url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/861","id":208929596,"user":{"login":"marcoow","id":1510,"avatar_url":"https://avatars.githubusercontent.com/u/1510?v=3","gravatar_id":"","url":"https://api.github.com/users/marcoow","html_url":"https://github.com/marcoow","followers_url":"https://api.github.com/users/marcoow/followers","following_url":"https://api.github.com/users/marcoow/following{/other_user}","gists_url":"https://api.github.com/users/marcoow/gists{/gist_id}","starred_url":"https://api.github.com/users/marcoow/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marcoow/subscriptions","organizations_url":"https://api.github.com/users/marcoow/orgs","repos_url":"https://api.github.com/users/marcoow/repos","events_url":"https://api.github.com/users/marcoow/events{/privacy}","received_events_url":"https://api.github.com/users/marcoow/received_events","type":"User","site_admin":false},"created_at":"2016-04-12T14:19:38Z","updated_at":"2016-04-12T14:19:38Z","body":"@atonse: I guess to make the current implementation a bit more stable (and the failure scenario less likely to happen) we could maybe use the visibility API somehow so that refresh requests would only be made from the visible tab/window or so."}}