fix: prevent 401 errors on authenticated media after service worker restart#516
Merged
7w1 merged 3 commits intoSableClient:devfrom Mar 25, 2026
Merged
fix: prevent 401 errors on authenticated media after service worker restart#5167w1 merged 3 commits intoSableClient:devfrom
7w1 merged 3 commits intoSableClient:devfrom
Conversation
Three changes to src/sw.ts: 1. Fix early-return bug in fetch handler: when sessions.get(clientId) returns a session but validMediaRequest(url, session.baseUrl) fails (e.g. multi-account users on different homeservers, or URL format mismatch), the old code returned without calling event.respondWith(), causing the browser to make an unauthenticated request → 401. Now we only short-circuit if BOTH conditions are met. 2. Proactively broadcast requestSession to all window clients in the activate event. After a SW restart the sessions Map is empty; the old code relied on the first intercepted media fetch to trigger requestSessionWithTimeout. Now the SW pre-populates the Map right after claiming clients, eliminating the 3-second race window. 3. Add loadPersistedSession() as a final fallback in the fetch handler. If requestSessionWithTimeout returns nothing ( Three changes to src/sw.ts: 1. Fix early-return bug in fetch handler: when sessions.get(clientId) returns a session buo a 1. Fix early-return bug i
On SW restart the in-memory sessions Map is empty. Previously the fetch handler fell through to requestSessionWithTimeout (3 s race window), so all simultaneous thumbnail loads during that window 401'd. Changes: - Populate preloadedSession from Cache Storage in the activate handler so media fetches get immediate auth before the first live setSession arrives from the page. - Include preloadedSession in the byBaseUrl fast path so the synchronous branch handles the burst of thumbnail requests without waiting at all. - Clear preloadedSession as soon as any real setSession arrives so stale tokens cannot linger. - Handle empty clientId (uncontrolled-context fetches) by falling through to byBaseUrl / preloadedSession / loadPersistedSession instead of doing a bare return that bypassed respondWith and caused an unauthenticated request.
Contributor
Author
|
Edit: Actually, I think the messages are just rendering out of order (which I don't think is related to this PR) - Clicking on a message notification brings me to the message, at the top of the synced message group. Should be fixed by 1. in #529 |
7w1
approved these changes
Mar 25, 2026
github-merge-queue bot
pushed a commit
that referenced
this pull request
Mar 28, 2026
> [!IMPORTANT] > Merging this PR will create a new release. ## Features * Add ability to click on usernames in member and state events to view user info ([#536](#536) by @thundertheidiot) * Add black theme ([#437](#437) by @Elec3137) * added a limited compatibility with `pk;member` commands ([#550](#550) by @dozro) * Add /location sharing command, and a /sharemylocation command. ([#509](#509) by @nushea) * added option to use shorthands to send a message with a Persona, for example `✨:test` ([#550](#550) by @dozro) * Add quick reply keybinds by using <kbd>ctrl</kbd>+<kbd>up</kbd> / <kbd>ctrl</kbd>+<kbd>down</kbd> you can now cycle through the message you are replying to with keybinds ([#524](#524) by @CodeF53) * Adds a `/html` command to send HTML messages ([#560](#560) by @Vespe-r) * Add room abbreviations with hover tooltips: moderators define term/definition pairs in room settings; matching terms are highlighted in messages. ([#514](#514) by @Just-Insane) * Add support for timestamps, playlists and youtube music links for the youtube embeds ([#534](#534) by @thundertheidiot) * Add settings sync across devices via Matrix account data, with JSON export/import ([#515](#515) by @Just-Insane) ## Fixes * Add detailed error messages to forwarding failures. ([#532](#532) by @7w1) * Cap unread badge numbers at `1k+`, and something extra :) ([#484](#484) by @hazre) * Fix scroll-to-bottom after room navigation, timeline pagination reliability, and URL preview deduplication. ([#529](#529) by @Just-Insane) * Fixes the most recent pmp message in encrypted rooms not consistently rendering the pmp and not grouping with previous pmps. ([#526](#526) by @7w1) * fixed sending sticker and attachments while having a persona selected ([#525](#525) by @dozro) * Fix push notifications missing sender/room avatar and showing stale display names when using event_id_only push format. ([#551](#551) by @Just-Insane) * Sanitize formatted reply previews before rendering to prevent unsafe HTML from being parsed in reply snippets. ([#569](#569) by @Just-Insane) * Fix broken link to Sliding Sync known issues — now points to #39 instead of the old repository. ([#519](#519) by @Just-Insane) * Fix service worker authenticated media requests returning 401 errors after SW restart or when session data is missing/stale. ([#516](#516) by @Just-Insane) * rephrased the command describtion for `/usepmp` and made `/usepmp reset` actually reset the room association of the pmp ([#550](#550) by @dozro) * Fix confusing ui with `Client Side Embeds in Encrypted Rooms` setting ([#535](#535) by @thundertheidiot) * fix forwarding metadata by removing the `null` value ([#540](#540) by @dozro) * fix forwarding issue for users on synapse homeservers, by removing the relation ([#558](#558) by @dozro) * fixed the syntax issues regarding `/addpmp` and `usepmp` (note that the syntax for `/usepmp` has changed) ([#550](#550) by @dozro) * fix the display of jumbo emojis on messages sent with a persona ([#530](#530) by @dozro) * Fix sidebar notification badge positioning so unread and unverified counts align consistently. ([#484](#484) by @hazre) * Use the browser's native compact number formatting for room and member counts. ([#484](#484) by @hazre) * fix(sentry): scrub percent-encoded Matrix IDs and opaque base64url tokens from Sentry URLs ([#531](#531) by @Just-Insane) ## Notes * new/changed bios will now also be saved in the format MSC4440 expects ([#559](#559) by @dozro) * moved the setting for filtering pronouns by language from experimental to the appearance setting ([#521](#521) by @dozro)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The service worker (SW) loses its in-memory session on restart (e.g. after the browser kills the SW background process). Any authenticated media request arriving before the SW re-reads session data from cache was returning a 401.
Two fixes:
activate: the SW now reads session data from the cache during theactivateevent, so it is available immediately when the firstfetchevent fires.Authorizationheader (previously an empty/invalid token was injected, causing the 401).Fixes #
Type of change
Checklist:
AI disclosure:
Attempts to resolve issues with the service worker not properly storing and/or refreshing media auth tokens on load. The changes mainly serve to ensure that a session is persisted during restarts (and then drop the persisted session once a live one is available). Also helps with refreshing tokens (
sw.tsln 651-661)