laststance / laststance/gitbox
Multi-tab PKCE collision causes invalid grant on slower tab
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 5
- Forks
- 2
- Avg merge
- 6h 9m
- Merged PRs (30d)
- 2
Description
Summary
Concurrent OAuth flows in multiple tabs clobber the Supabase code-verifier cookie.
Source
P2 follow-up from /ship adversarial review of PR #176 (silent GitHub token refresh).
Details
Tab A mid-refresh + Tab B clicking "Sign in with GitHub" can clobber the Supabase sb-…-code-verifier cookie, causing "invalid grant" on the slower tab's /auth/callback.
Fix
Detect "code verifier mismatch" specifically in callback and treat as recoverable (silent restart) rather than surfacing the raw error.
Acceptance
- Slower tab does not show raw "invalid grant" error
- Recoverable case triggers silent restart
- Test reproduces multi-tab collision
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the /auth/callback flow and trace how the Supabase sb-…-code-verifier cookie is read and how verifier mismatches are reported. Reproduce the collision with two concurrent tabs, then add a test for the slower callback. Done means the raw "invalid grant" is not shown and the recoverable case silently restarts.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication, web-dev
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100