forcedotcom / forcedotcom/cli

sf org login race condition on Linux

Open
#3,643 4 comments 0 reactions 0 assignees View on GitHub
bug investigating validated
Dominant language
No language data
Stars
571
Forks
80
Avg merge
2d 15h
Merged PRs (30d)
3

Description

### Summary
There is currently a race condition in the auth logic on (some?) linux devices when using the `sf org login web` command. This results in a hang after opening the browser, since the CLI does not know that the browser has already been opened.

### Steps To Reproduce

1. Run `sf org login web -r https://mysite.my.salesforce.com -a myalias --dev-debug`
2. Complete the OAuth flow in your browser.
3. Observe as the browser hangs.

### Expected result
The OAuth flow should complete successfully.

### Actual result
The browser hangs until the CLI times out and closes all connections.

### Additional information
I have traced the root cause of this problem down to a race condition in `web.js` - specifically `executeLoginFlow`:

After calling `await open(oauthServer.getAuthorizationUrl(), openOptions)`, the callback handler sets up an exit event handler (`childProcess.on('exit'`), however the process has already exited (`childProcess.exitCode == 0`), so the exit handler never fires.

With `--dev-debug` logs, you will see that `Opening browser ${browserApp ?? ''}` is the last line logged, but the following `Successfully opened browser ${browserApp ?? ''}` never shows up.

### System Information
Verified with bash.

```json
{
"architecture": "linux-x64",
"cliVersion": "@salesforce/cli/2.150.6",
"nodeVersion": "node-v24.19.0",
"osVersion": "Linux 7.1.11-zen1-1-zen",
"rootPath": "/home/russell/.local/sfcli",
"shell": "bash",
"pluginVersions": [
"@oclif/plugin-autocomplete 3.3.0 (core)",
"@oclif/plugin-commands 4.2.0 (core)",
"@oclif/plugin-help 6.3.0 (core)",
"@oclif/plugin-not-found 3.3.0 (core)",
"@oclif/plugin-plugins 5.5.1 (core)",
"@oclif/plugin-search 1.3.0 (core)",
"@oclif/plugin-update 4.8.0 (core)",
"@oclif/plugin-version 2.3.0 (core)",
"@oclif/plugin-warn-if-update-available 3.2.0 (core)",
"@oclif/plugin-which 3.3.0 (core)",
"@salesforce/cli 2.150.6 (core)",
"agent 2.0.5 (core)",
"apex 4.1.1 (core)",
"api 2.0.9 (core)",
"auth 5.0.6 (core)",
"data 5.1.7 (core)",
"deploy-retrieve 4.1.2 (core)",
"info 4.0.9 (core)",
"limits 4.0.4 (core)",
"marketplace 2.0.5 (core)",
"org 6.0.11 (core)",
"packaging 3.0.6 (core)",
"schema 4.0.6 (core)",
"settings 3.0.6 (core)",
"sobject 2.0.5 (core)",
"telemetry 4.0.6 (core)",
"templates 57.0.11 (core)",
"trust 4.0.10 (core)",
"user 5.0.2 (core)"
]
}
```
`sf version --verbose --json` returned an exception when run normally. Turns out this is an upstream bug in the oclif version plugin caused by npm 12.

Contributor guide

Open the contributing guide

Research direction

Start in web.js at executeLoginFlow and trace the interaction between open(oauthServer.getAuthorizationUrl(), openOptions) and the childProcess exit handler. Reproduce with sf org login web on Linux and --dev-debug, then verify that the OAuth flow completes and the successful browser-open message appears instead of the CLI timing out.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
authentication, cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.