Infinite refresh loop in react native

Question

< nkshah2> Can you please help

nkshah2 · Answer

Hi < Malik Khoja> What backend sdk and version are you using

rp · Answer

This is the original question for reference We are using SuperToken 3 2 0 in our React Native Application 0 70 6 Android We encountered an ANR issue in few of the devices where SuperToken goes in loop to get the access token and which results in ANR One Scenario we encountered is if user changes the date or time it occurs

Malik Khoja · Answer

Ok

rp · Answer

< Malik Khoja> which backend SDk are you using

Malik Khoja · Answer

supertoken node 12 1 5

Malik Khoja · Answer

Sorry for the late reply

Malik Khoja · Answer

We can see in our backend that multiple sessions are been created for same user Can this be a reason for ANR

Malik Khoja · Answer

< nkshah2> < rp> Please let us know as this is creating lot of issues at our end in Production environment

rp · Answer

which frontend sdk are you using ANd which version

rp · Answer

> that multiple sessions are been created for same user What do you mean There should only be one session per user login right

Malik Khoja · Answer

Yes there should be

Malik Khoja · Answer

We are using SuperToken 3 2 0 in our React Native Application 0 70 6 Android

Malik Khoja · Answer

Can you help us understand what can cause multiple session to be created

rp · Answer

which version of our frontend SDK are you using

rp · Answer

and which frontend SDK

rp · Answer

> Can you help us understand what can cause multiple session to be created One use login should create one session for them So if a user logs into many devices at the same time they will have multiple sessions one per device

Malik Khoja · Answer

Ohk

Malik Khoja · Answer

SuperToken 3 2 0

Malik Khoja · Answer

Front end sdk version

rp · Answer

which sdk is this

rp · Answer

android ios react native

rp · Answer

SuperToken 3 2 0 > whats this

rp · Answer

> if user changes the date or time it occurs This can cause issues in which the backend and frontend go out of sync so if the date time is not the real time it can cause this

rp · Answer

does the infinite loop happen even if the user does not change the date time

Malik Khoja · Answer

react native

rp · Answer

you are not being very helpful Im sorry can t really help out here without more info on what might be wrong

Malik Khoja · Answer

What info do you need

rp · Answer

how to reproduce the issue If you have any backend debug logs If you have any backend error stack trace relevant to this issue

Malik Khoja · Answer

For all of my customers device id is empty in supertoken We believe this is causing multiple sessions

Malik Khoja · Answer

Can you help me understand from where does SuperToken picks Device ID

rp · Answer

it doesn t

rp · Answer

im not sure what you mean by device ID

Malik Khoja · Answer

Ok so how does super token identifies unique user As you mentioned earlier it will create a unique session for one device

rp · Answer

based on the login method

Malik Khoja · Answer

there is a table passwordless devices

Malik Khoja · Answer

What do u mean by Login Method

rp · Answer

that table is only used during login it stores the passwordless login session

Malik Khoja · Answer

we are only using passwordless login method

rp · Answer

right

Malik Khoja · Answer

and we can see multiple session created for same user

Malik Khoja · Answer

So we need to understand the root cause that why it would be happening

rp · Answer

are they logging into multiple devices

Malik Khoja · Answer

No

rp · Answer

is your session flow even working

rp · Answer

refreshing sign out etc

Malik Khoja · Answer

Also how do u even identify unique devices

rp · Answer

when you sign out does it clear the session from the database

rp · Answer

> how do u even identify unique devices We don t need to

rp · Answer

this issue has nothing to do with passwordless login

rp · Answer

first we need to make sure that session works

rp · Answer

does sign out work as expected

Malik Khoja · Answer

Yes it works

Malik Khoja · Answer

Signout is working fine

rp · Answer

it clears the session from the db

rp · Answer

whats this issue about infnite refresh loop or something else

rp · Answer

im quite confused

Malik Khoja · Answer

Yes it does When user doesnt do signout and the session is still open

rp · Answer

hmm okay

Malik Khoja · Answer

So for example if I login today with password less method and then next day if I open my app then it doesnt gets opened

Malik Khoja · Answer

and multiple sessions are created

Malik Khoja · Answer

no Signout done

Malik Khoja · Answer

here

rp · Answer

hm

rp · Answer

you can reproduce this issue

Malik Khoja · Answer

Yes we can as it causes ANR

rp · Answer

whereall are you creating a session on the backend

Malik Khoja · Answer

Android Not Responding and it crashes the app

rp · Answer

whereall are you creating a session on the backend

Malik Khoja · Answer

Only when the user logs in

rp · Answer

right So you are saying after one day or logging in when i visit the app it causes multiple sessions to be created Does this happen if i visit the app lesser than one day after logging in

Malik Khoja · Answer

No it doesnt

rp · Answer

hmm

Malik Khoja · Answer

It happens after one day only

rp · Answer

24 hours Or just past midnight

Malik Khoja · Answer

and when I clear my app data everything works as it clears all the token from the cookies

Malik Khoja · Answer

past midnight

rp · Answer

i see

Malik Khoja · Answer

as we have tested this with less than 24hrs also

rp · Answer

what are the API calls that are made when this happens Do you have logs for that

Malik Khoja · Answer

Unfortunately no

rp · Answer

if you can reproduce it then maybe you can see the backend logs at the time this happens I would need more info

Malik Khoja · Answer

hmm ok

Malik Khoja · Answer

We are just trying to understand why multiple sessions are created

Malik Khoja · Answer

as we revoked all session of a internal user except one latest session and it works

rp · Answer

we can get there let s first see which APis are being called Then we can see what those APIs are doing

Malik Khoja · Answer

Ok

Malik Khoja · Answer

auth signinup code auth signinup code consume

Malik Khoja · Answer

1st one to create the otp and second one to verify it

rp · Answer

right So each time the `auth signinup code consume` is called it will create a new session if the request body is right

rp · Answer

do these APIs get called on their own How does the consume API know what the code is without the user entering it

Malik Khoja · Answer

No it wont get called automatically

Malik Khoja · Answer

One scenario can be if a user log s in by calling consume api then does clear data so all session is broken and then user enters the mobile no and otp by calling consume

Malik Khoja · Answer

a new session would be created and this will lead to multiple session

Malik Khoja · Answer

as logout was never been called

Malik Khoja · Answer

ideally if there is a valid session exists then consume should return the same session rather than creating a new session Correct me if wrong

rp · Answer

not really consume should create a new session It s better from a security point of view

rp · Answer

The scenario you describe makes sense but it s not in line with what you said earlier where it causes an infinite refresh loop and that after midnight somehow new sessions are created

rp · Answer

I think you need to get clarity on what s happening only then i can help since this is free Good luck

Malik Khoja · Answer

Thanks for the quick revert We understand that we have been discussing multiple scenarios here as our whole agenda is to find the issue As we feel discussing multiple issues would help you understand our problem better and help us understand what we are doing it wrong

rp · Answer

let s try and solve one issue at a time

Malik Khoja · Answer

Sure

rp · Answer

The consume code API creating a new session is expected

Malik Khoja · Answer

Yes

rp · Answer

if the user clears their app data they will be logged out and when the login again it will get them a new session this is expected You could override the createNewSession on the backend to revoke other sessions belonging to this user if you want but this would also mean that if the user has indeed logged into another device their previous devices would be logged out

Malik Khoja · Answer

Ohk

Malik Khoja · Answer

supertoken reactnative 3 2 0 supertoken node 12 1 5 supertoken docker 4 4 1

Malik Khoja · Answer

Just for information sharing the version no used across all the end

Malik Khoja · Answer

As consume will create a new session every time expected behaviour then how does SuperToken identify unique user or devices or it doesnt

rp · Answer

it doesn t need to

rp · Answer

consume should only be called when the user is logging in

rp · Answer

which should only happen if the user is not already logged in

Malik Khoja · Answer

Also docker server was started again a month ago and when we started it pulls up a new image of the version and we can see the increase in this issues since march Do you think this can be because of the updated version or version mismatch

Malik Khoja · Answer

Ok so in case of clear data you recommend to clear previous user session if any

rp · Answer

The new core should be working with the version of the SDK you are using But you should ideally not have it auto pull the latest core That s generally a bad idea

rp · Answer

Not really I would say keep it as is But you could clear older sessions when a new one is created as I said before

Malik Khoja · Answer

Ok