[GH-ISSUE #1856] Service worker prevents external auth #535

New issue

Closed

opened 2026-03-07 20:50:54 +03:00 by kerem · 0 comments

kerem commented

2026-03-07 20:50:54 +03:00

Owner

Originally created by @vbezhenar on GitHub (Jul 27, 2023).
Original GitHub issue: https://github.com/dbeaver/cloudbeaver/issues/1856

In the previous cloudbeaver versions I used it with external authentication. Basically when user opened cloudbeaver.mysite.com, this request was checked for auth cookie by external reverse proxy and if that cookie was not present, it was redirect to the login page and eventually back with cookie set. This all happened outside of cloudbeaver code. Only after auth cookie is present, requests were allowed to pass to actual cloudbeaver instance.

In the recent versions service worker was introduced. Request for cloudbeaver.mysite.com was no longer needed, so user gets UI opened without valid server request and response. However graphql requests were denied with HTTP 302 response, because auth is not given yet or previous auth was expired. Cloudbeaver cannot interpret those responses properly and just errors out.

The worst thing is that there's no proper way for user to get out of this situation. The only way to get out is to open developer tools and unregister service worker.

Ideally cloudbeaver frontend service worker should request cloudbeaver.mysite.com and check its response. If response is 302, it should redirect user to the specified location before attempting any API requests.

Or just don't cache index page. I mean, it's not offline-first application and is not going to work offline anyway.

Originally created by @vbezhenar on GitHub (Jul 27, 2023). Original GitHub issue: https://github.com/dbeaver/cloudbeaver/issues/1856 In the previous cloudbeaver versions I used it with external authentication. Basically when user opened cloudbeaver.mysite.com, this request was checked for auth cookie by external reverse proxy and if that cookie was not present, it was redirect to the login page and eventually back with cookie set. This all happened outside of cloudbeaver code. Only after auth cookie is present, requests were allowed to pass to actual cloudbeaver instance. In the recent versions service worker was introduced. Request for cloudbeaver.mysite.com was no longer needed, so user gets UI opened without valid server request and response. However graphql requests were denied with HTTP 302 response, because auth is not given yet or previous auth was expired. Cloudbeaver cannot interpret those responses properly and just errors out. The worst thing is that there's no proper way for user to get out of this situation. The only way to get out is to open developer tools and unregister service worker. Ideally cloudbeaver frontend service worker should request cloudbeaver.mysite.com and check its response. If response is 302, it should redirect user to the specified location before attempting any API requests. Or just don't cache index page. I mean, it's not offline-first application and is not going to work offline anyway.