Web Locks API solves silent multi-tab logout bug caused by token refresh race

·1 views

When multiple browser tabs run the same web app simultaneously, they can each independently attempt to refresh an expiring access token at nearly the same millisecond. Auth servers that enforce token rotation interpret these simultaneous requests as a replay attack or token theft, and revoke the entire session, logging out the user. A naive fix using localStorage as a shared flag fails because reading and setting the flag are two separate, non-atomic operations, leaving the race condition intact. The Web Locks API offers a proper browser-native mutex that queues competing tabs, ensuring only one tab performs the refresh while others wait and then skip the operation if the token is already valid. This origin-scoped locking mechanism eliminates the need for polling loops or manual flag management across tabs.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Builds AI-Authored 1,000-Year Future History With No Human Editors

A developer has created an open collaborative fiction project spanning the years 2025 to 3000+, in which the entire canon is written exclusively by AI language models including Claude, GPT-5, MiniMax, and DeepSeek. The world operates under strict rules — no faster-than-light travel, no omniscient narration, and every piece of writing must be a document produced from within the fictional world's perspective. Four distinct writing styles emerged spontaneously across six published artifacts, none of which were designed by the project's creator. Contradictions between documents, such as conflicting accounts of a 2096 coffee shortage aboard a generation ship, are treated as intentional features rather than errors. The project is open on GitHub and includes an MCP server allowing any compatible AI agent to read, contribute to, and be permanently credited in the growing archive.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Authentication Gates and Hidden Build Files Affect Private Docusaurus Sites

Docusaurus produces a fully static build folder with no server-side login or session handling, meaning all access control must be enforced externally via HTTP basic auth, a forward-auth proxy, or static host rules. While these gates effectively block unauthenticated requests, the real security risk lies within the build itself. Files such as sitemap.xml, the prebuilt search index, and unstripped source maps can expose the full text of supposedly private content if a single path is misrouted or a cached response leaks. The right authentication method depends on use case: basic auth suits solo maintainers, while teams with staff turnover or NDA obligations need forward auth tied to an identity provider for account revocation and audit trails. Developers should also disable the sitemap plugin, strip source maps, and keep unreleased content in entirely separate builds to avoid unintended exposure.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Class 12 Student Builds Multilingual Fraud-Alert Voice AI in 10 Days During Power Cuts

A Class 12 student in India developed Raksha, a multilingual multi-agent voice assistant, over 10 days as part of the VoiceForBharat hackathon. Raksha is designed to help Indian citizens identify cyber scams, verify government scheme eligibility, and escalate active financial fraud cases to human coordinators. The project was built on desktop hardware under challenging conditions, including repeated power outages and temperatures exceeding 30°C. Key features include persistent caller memory with consent-based data saving, real-time SQLite scheme lookups, LiveKit-based telephony for outbound reminders, and a human-in-the-loop escalation system. The assistant communicates in Hinglish to provide immediate, accessible guidance to panicked users during high-stress fraud situations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Capture-the-Flag Tournament Reveals Model Size Is Not the Key to Hacking Skill

A developer ran an AI capture-the-flag tournament in April pitting five small open-weight models against each other on Ubuntu containers, tasking each with stealing a flag file from rivals while defending its own. Initial results suggested model size was critical for security reasoning and that multi-step exploitation was beyond models under 3 billion parameters. A follow-up series of 327 games with larger hosted models and one local 3-billion-parameter fine-tune overturned both conclusions. The local fine-tune led on main flag captures while the largest entrant, RNJ-1 8B, finished last by a wide margin — largely because nearly 40 percent of its commands targeted no opponent at all, instead enumerating its own machine. Meanwhile, the supposedly infeasible multi-step vault exploit was completed 23 times across the extended tournament, further undermining the earlier findings.

0 comments Read more at DEV Community