Expired session renders pages signed-out instead of redirecting to login #293

New Issue

2026-10-25T23:12:29-04:00

logan commented

2026-10-25 23:12:29 -04:00

Found in the 2026-10-25 Chrome sweep. Searched open+closed: no duplicate.

Mid-session, a click from /nodes into /nodes/RPI-Node-01 rendered the node page with no nav, "Couldn't load Discord radio: Missing authorization token", System "Unassigned", no admin buttons, and a Firestore permission-denied in the console. The next navigation redirected to /login. After signing in again the same path worked.

Likely: Firebase user went null (token refresh failed / session expired) while the client-set drb_session cookie was still present, so middleware let the page render and every data call failed. AuthProvider clears the cookie on null user, but pages already mounted do not react.

User-visible effect matches the owner's report "archive and incident buttons are broken": pages look broken/empty rather than bouncing to sign-in.

Fix shape: when useAuth() resolves to no user on a protected page, router.replace("/login") (a client-side guard in the app shell), and/or surface a "session expired, sign in again" banner on 401 (C2ApiError status 401 from #286 already has the message).

Could not reproduce the drop on demand; needs-info on what expires the session.

Found in the 2026-10-25 Chrome sweep. Searched open+closed: no duplicate. Mid-session, a click from /nodes into /nodes/RPI-Node-01 rendered the node page with no nav, "Couldn't load Discord radio: Missing authorization token", System "Unassigned", no admin buttons, and a Firestore permission-denied in the console. The next navigation redirected to /login. After signing in again the same path worked. Likely: Firebase user went null (token refresh failed / session expired) while the client-set drb_session cookie was still present, so middleware let the page render and every data call failed. AuthProvider clears the cookie on null user, but pages already mounted do not react. User-visible effect matches the owner's report "archive and incident buttons are broken": pages look broken/empty rather than bouncing to sign-in. Fix shape: when useAuth() resolves to no user on a protected page, router.replace("/login") (a client-side guard in the app shell), and/or surface a "session expired, sign in again" banner on 401 (C2ApiError status 401 from #286 already has the message). Could not reproduce the drop on demand; needs-info on what expires the session.

logan added the

type

bug

area/frontend area/auth

labels 2026-10-25 23:12:29 -04:00

logan referenced this issue

2026-10-25 23:13:54 -04:00

Frontend: fixes from the 10-25 Chrome sweep #294