Web Locks API Prevents Multi-Tab JWT Refresh Storms in Single-Page Apps

In single-page applications, each browser tab runs in its own isolated JavaScript environment, meaning in-memory flags like 'isRefreshing' cannot communicate across tabs. When a JWT access token expires and multiple tabs are open, each tab independently fires a refresh request simultaneously, which can revoke previously issued tokens and log users out entirely. This problem, known as the Cross-Tab Token Trap, is especially destructive on backends that enforce single-use refresh token rotation. The Web Locks API, a native browser feature supported in Chrome 69+, Firefox 96+, and Safari 15.4+, offers a fix by allowing tabs on the same origin to request an exclusive named lock. When one tab holds the lock to refresh the token, other tabs are automatically paused by the browser until the refresh completes, after which they retrieve the updated token from localStorage instead of making redundant server calls.