-
-
Notifications
You must be signed in to change notification settings - Fork 20
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
(error code: 0x80090308) on session timeouts w/ multiple requests #116
Comments
Today i tried it by adding the Using this it seems to work fine on multiple requests at once after the session timed out. Just dumps of schManager.cache on set/release/get: Before "Forwarded":
After:
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
This is related to #91 and if the proxy is not set to keep alive, multiple requests in a short duration will all fail to authenticate with the message
Error: AcceptSecurityContext: SECURITY_STATUS incorrect (<0): (error code: 0x80090308) [invalid token message]
because a server context handle could not be found.If I request now multiple files (after the timeout of the session) using something like:
all requests will fail. But if i request one first and then the rest (during the session period) everything is fine.
From what I can tell the handle get's added and removed all over again using the configuration values mentioned in #91. I suggest changing the handle name/detection to something different instead of a handle based on the client IP, if possible. There are enough values in the header block that could help creating a more unique handle to search for.
On the other side, if useSession is enabled you could store the serverContextHandle tempoarily inside the session instead of the ServerContextHandleManager.
I have also implemented locally a small addition inside the catch block at auth.js for two of the error codes related to SECURITY_STATUS in cases where the session timed out it triggers 0x80090308 or 0x80090310. If so i just ask the client to auth again using a forward request with Status 308. So
fetch()
orXMLHttpRequest()
create a new session again without any problem. (But only one request for a given IP at a time... :/)But I'm not sure if this fits for everyone. Header Status 308 tells the client also to
resendforward form data and so on.The text was updated successfully, but these errors were encountered: