fix(auth): auto-redirect to login on 401 when JWT expires - #331
Merged
Conversation
- Emit custom window event `api:unauthorized` on any 401 response in APIClient (both request() and requestWithMeta()) - AuthProvider listens for the event and dispatches AUTH_LOGOUT when the user is supposedly authenticated, causing ProtectedRoute to render LoginPage immediately instead of showing error alerts - Hide logout button in UserMenu when login is not required - Return anonymous admin user from /api/user endpoint when auth is disabled so no-auth mode works without a logged-in user Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
yoshitaka420
pushed a commit
to yoshitaka420/altmount
that referenced
this pull request
Jun 1, 2026
) - Emit custom window event `api:unauthorized` on any 401 response in APIClient (both request() and requestWithMeta()) - AuthProvider listens for the event and dispatches AUTH_LOGOUT when the user is supposedly authenticated, causing ProtectedRoute to render LoginPage immediately instead of showing error alerts - Hide logout button in UserMenu when login is not required - Return anonymous admin user from /api/user endpoint when auth is disabled so no-auth mode works without a logged-in user Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
api:unauthorizedwindow event whenever any API call returns HTTP 401 (in bothrequest()andrequestWithMeta()inAPIClient)AuthProviderlistens for the event and dispatchesAUTH_LOGOUTwhen the user is currently authenticated — causingProtectedRouteto render<LoginPage />immediatelyUserMenuwhenloginRequired === false(auth-disabled mode)GET /api/userwhen auth is disabled, so the endpoint works in no-auth modeProblem solved
When the JWT expired, polling queries (e.g. dashboard stats every 5 s) started returning 401. The frontend had no global 401 handler, so each page showed an
<ErrorAlert>("Authentication required") whileisAuthenticatedremainedtrue. The user was stuck.Test plan
login_required: truelogin_required: false), no logout button is shown and the user menu still worksbun run checkpasses with no TypeScript errors🤖 Generated with Claude Code