PipedreamHQ / PipedreamHQ/pipedream
[BUG] Connect iframe closes if Continue is clicked before token validation finishes
- Dominant language
- JavaScript
- Stars
- 11.7k
- Forks
- 5.8k
- Avg merge
- 3d 10h
- Merged PRs (30d)
- 102
Description
## Describe the bug
The hosted Pipedream Connect dialog iframe appears to have a race condition during initial load.
The page starts an async validation request to:
- `GET /v1/connect/tokens/{token}/validate`
However, before that request finishes, the `Continue` button is already clickable.
If the user clicks `Continue` too early:
- OAuth does not start
- no useful error is shown
- the dialog closes immediately
This makes the flow look like a no-op instead of a loading state.
## To Reproduce
1. Open a Pipedream Connect iframe URL like:
- `https://pipedream.com/_static/connect.html?token=...&app=gmail`
2. Ensure the validation request has not finished yet, for example by using slow network throttling.
3. Click `Continue` quickly after the page appears.
4. Observe that:
- OAuth does not start
- the dialog closes
- no actionable error is shown
## Expected behavior
One of the following should happen instead:
- `Continue` should remain disabled until token validation finishes
- or clicking `Continue` should wait for validation to complete
- or the page should show an explicit loading state rather than closing
The dialog should not close just because validation is still in progress.
## Screenshots
If helpful, screenshots can be attached for:
- the initial Connect screen with the visible `Continue` button
- the network panel showing `GET /v1/connect/tokens/{token}/validate`
- the dialog closing when `Continue` is clicked before validation completes
## Additional context
Investigation date:
- April 15, 2026
Observed behavior in the hosted Connect page:
- iframe URL:
- `https://pipedream.com/_static/connect.html?token=...&app=...`
- observed script bundle:
- `https://pipedream.com/_static/connect.da939752.js`
- observed validation request:
- `GET https://api.pipedream.com/v1/connect/tokens/{token}/validate?app_id=...`
What appears to be happening internally:
1. The page starts async validation on load.
2. The initial screen renders before validation has necessarily completed.
3. The `Continue` button is still clickable during that window.
4. The click path appears to depend on app metadata populated by validation.
5. If that metadata is not ready yet, the page falls through to a close / exit path instead of waiting.
From inspection of the shipped frontend bundle, this looks like a race in the hosted Connect frontend, not just in the SDK wrapper.
Why this matters:
- users can lose a connect attempt with no explanation
- the bug becomes easier to trigger on slower connections
- it feels intermittent and confusing because it depends on timing
Suggested fix:
1. Disable `Continue` until `/validate` resolves.
2. Or make the `Continue` handler await the pending validation promise.
3. Or treat "validation still loading" as a loading state instead of closing the dialog.
Potentially relevant wording for the bug:
- clicking `Continue` before `/v1/connect/tokens/{token}/validate` finishes closes the dialog instead of waiting for validation
Contributor guide
Assessment
This issue has not been assessed yet.