Merge pull request #23915 from apc-kamezaki/feature/handle-error-tech…

…docs-cookie

fixed bug the treat as same as no cookie if existing cookie vas invalid.

.changeset/giant-olives-protect.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-app-api': patch
+---
+
+Fixed a bug where expired cookies would not be refreshed.

packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts

@@ -235,14 +235,24 @@ class DefaultHttpAuthService implements HttpAuthService {
       return undefined;
     }
 
-    const existingCredentials = await this.#auth.authenticate(existingCookie, {
-      allowLimitedAccess: true,
-    });
-    if (!this.#auth.isPrincipal(existingCredentials, 'user')) {
-      return undefined;
-    }
+    try {
+      const existingCredentials = await this.#auth.authenticate(
+        existingCookie,
+        {
+          allowLimitedAccess: true,
+        },
+      );
+      if (!this.#auth.isPrincipal(existingCredentials, 'user')) {
+        return undefined;
+      }
 
-    return existingCredentials.expiresAt;
+      return existingCredentials.expiresAt;
+    } catch (error) {
+      if (error.name === 'AuthenticationError') {
+        return undefined;
+      }
+      throw error;
+    }
   }
 }