slow connections cause /authn/refresh request to be replayed, causing session termination

Technical Summary: As part of the RTR lifecycle we use a flag in local-storage as a way to synchronize refresh requests across multiple tabs. To avoid the problem of a cancelled request leaving cruft in storage, we inspect the timestamp on the flag and consider a request "stale" if it's too old. That was the problem here: our "too old" timeout was too short; on a busy server, or on a slow connection, or on a client far from its host (say, in New Zealand), two seconds was not long enough. The rotation request would still be in-flight when stripes considered it "stale", allowing a second request to go through. But since the first request was just slow, not dead, the second one is treated as a token-replay attack by the backend, causing all active sessions for that user account to be immediately terminated.

Thus, waiting longer (20 seconds instead of 2 seconds) is a quick fix.

Original Overview: In the Bulk Edit application, when the user downloads a file with a user barcode and reloads the page with 'Preview of record matched,' the page does not fully render, or sometimes the application displays a 'Something went wrong' page.
This issue may occur after the API call POST 'authn/refresh'.

Note: This typically happens when the user logs into the application for the first time or opens the application from the Incognito mode of the browser.
This issue particularly affects automated tests.

IMPORTANT NOTE: After conducting further investigations, it was found that the issue occurs when the user experiences slow or unstable internet connectivity. The issue is reproducible when emulating a slow internet connection using browser-based network throttling set to 3G.

Precondition:
Authorized user with permissions:

"Bulk Edit: In app - Edit inventory records"
"Bulk Edit: In app - View inventory records"
"Bulk edit: In app - Edit user records"
"Users: Can edit user profile"

User has .csv file with the existing on the environment user barcode, ex:Loading file...

Steps to reproduce:

1. Navigate to the Bulk edit app => Select the "Users" radio button on  the "Record types" accordion => Select  "User barcodes" option from the "Record identifier" dropdown

2. Upload a .csv file  with "User barcodes" by dragging it on the "Drag & drop" area - The "Preview of record matched" accordion shows the table populated with matched Users records

3. Reload the page

Expected result: The "Preview of record matched" accordion shows the table populated with matched Users records.
Actual result: The page does not fully render, or sometimes the application displays a 'Something went wrong' page.

Please, see the attached screencast

Open

Open