RocketChat / RocketChat/EmbeddedChat

Memory leak in OAuth authentication flow

Open
#1,125 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
JavaScript
Stars
165
Forks
381
Avg merge
1d 2h
Merged PRs (30d)
1

Description

Description:

Memory leak in OAuth authentication flow where event listeners and interval timers are not cleaned up when login succeeds. The cleanup only happens when the popup is manually closed by the user.

Steps to reproduce:
  1. Enable OAuth authentication (authFlow: 'OAUTH')
  2. Click the login button to trigger loginWithRocketChatOAuth()
  3. Complete OAuth login successfully
  4. Check browser's event listeners and active intervals
Expected behavior:

After successful OAuth login, both the message event listener and the interval timer should be immediately removed from memory.

Actual behavior:

The event listener on window and setInterval continue running even after successful login. They only get cleaned up when the interval detects the popup is closed (up to 1 second delay), and if timing is unlucky, they may persist indefinitely. This causes memory leaks when users authenticate multiple times in a session.

Additionally, if the user closes the OAuth popup without completing login, the promise never resolves or rejects, leaving the app in a hanging state.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the loginWithRocketChatOAuth() entry point and reproduce the flow with authFlow: 'OAUTH', checking the window message listener and interval after successful login and after closing the popup. Done means successful login removes both resources immediately and closing the popup resolves or rejects the promise instead of leaving it hanging.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
authentication, frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.