feat: Add flag to control parallel transactions #2244
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds an
Auth0Client
flagenableParallelTransactions?: boolean
that controls behaviour of SDK for parallel transactions.This PR also adds some logic to ensure that transaction cookies are cleared in the event of a callback error.
📋 Changes
Adds configurable transaction cookie management to prevent accumulation while supporting multi-tab scenarios. New
AuthClient
constructor options:enableParallelTransactions: boolean
(default:true
) - Controls single vs multi-transaction modeUsage example for single-transaction mode:
Code changes:
src/server/auth-client.ts
: Added logic to delete transaction cookies after a callback is handled (on success or error).src/server/client.ts
: Plumbed theenableParallelTransactions
option through to theTransactionStore
.src/server/transaction-store.ts
: Implemented the logic to handle both single and parallel transaction modes.Test changes:
src/server/auth-client.test.ts
: Updated test mocks for new method signatures.src/server/client.test.ts
: Added tests to verifyenableParallelTransactions
is passed correctly.src/server/redundant-txn-cookie-deletion.test.ts
: Added an integration test suite withmsw
to verify the fix for the cookie accumulation bug.Docs changes:
EXAMPLES.md
: Added a "Transaction Cookie Configuration" section to document the new feature.README.md
: Updated the configuration options table withenableParallelTransactions
.V4_MIGRATION_GUIDE.md
: Added a section on the new transaction cookie management.📎 References
#1917
#2209
This PR aims to provide a possible solution to the transaction cookie pileup problem identified in the above issues. While not a complete solution, this can help bridge the gap b/w v3 and v4 behaviour.
Transaction cookies are created everytime
startInteractiveLogin
(called byhandleLogin
) redirects for login. These cookies are deleted once the callback handlerhandleCallback
either succeeds or throws and error(added in this change) for the specific transaction state for which it was called.These transaction cookies are NOT deleted when the callback handler is never called (the user navigates away from the login form (user manually doing this, or a misconfigured setup that ends up in an infinite redirect), in which case the cookies get automatically deleted a/c to their
maxAge
(this is 1hr by default, another PR will enable configuring this). If enough of these login attempts are cancelled before the txn cookie maxage, cookie storage can fill up.By using a
enableParallelTransactions = false
, a single transaction cookie will be used per browser window. If one login transaction is active, trying to login again will fail with a warning.