Skip to content

fix(auth): remove authorization timeout in OIDC login flow

Jérôme Revillard requested to merge fix/auth-timeout into main

Summary

  • Removed the 30-second hardcoded timeout on authorizeAndExchangeCode() in AuthNotifier.authorize()
  • OIDC authorization involves human interaction (Chrome Custom Tab login) — any arbitrary timeout is incorrect
  • Network operations (discovery, token refresh) retain their timeouts (10s, 15s respectively)

Problem

The authorize() method wrapped the entire authorizeAndExchangeCode() call in a 30-second .timeout(). This included the time the user spends in the Keycloak login page. Users who took more than 30 seconds to authenticate received an AUTH_TIMEOUT error.

Fix

Removed authorizeTimeout constant and the .timeout() wrapper from authorizeAndExchangeCode(). The discovery step (pure network operation) keeps its 10-second timeout. Token refresh keeps its 15-second timeout.

Test plan

  • Verify OIDC login succeeds without timeout on dev device
  • Verify discovery timeout (10s) still fires on network failure
  • Verify token refresh timeout (15s) still fires on network failure
  • Verify user cancellation still returns unauthenticated state
Edited by Jérôme Revillard

Merge request reports