Repository navigation
fix(auth): retry a 401 on a fresh connection and name it apart - #108
Merged
Merged
Conversation
The page load can open its connection without a client certificate and HTTP/2 then reuses it for WhoAmI, which the manager refuses with 401. The manager now closes a connection it refuses for that reason, so Log in retries WhoAmI once to get a fresh handshake where the browser can offer the certificate it holds. A 401 that survives the retry means a completed handshake in which the browser chose not to send a certificate. That was reported as no-certificate, the same as an aborted handshake, which told an operator with a certificate installed to install one. It is now its own reason with its own advice: restart the browser to clear a remembered refusal, or install a certificate if there is none. Closes #107 Refs: CryptOS-PKI/cryptos-manager#77
Merged
4 tasks done
Bugs5382
added a commit
that referenced
this pull request
Sep 25, 2026
The page load can open its connection without a client certificate and HTTP/2 then reuses it for WhoAmI, which the manager refuses with 401. The manager now closes a connection it refuses for that reason, so Log in retries WhoAmI once to get a fresh handshake where the browser can offer the certificate it holds. A 401 that survives the retry means a completed handshake in which the browser chose not to send a certificate. That was reported as no-certificate, the same as an aborted handshake, which told an operator with a certificate installed to install one. It is now its own reason with its own advice: restart the browser to clear a remembered refusal, or install a certificate if there is none. Closes #107 Refs: CryptOS-PKI/cryptos-manager#77
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
The page load can open its connection without a client certificate, and HTTP/2 then reuses it for
WhoAmI, which the manager refuses with 401 (CryptOS-PKI/cryptos-manager#77). The companion manager change, CryptOS-PKI/cryptos-manager#94, makes the manager close a connection it refuses for that reason.WhoAmIa single time afterUnauthenticated. Because the manager has closed the refused connection, the retry performs a fresh handshake where the browser can offer the certificate it holds. Any other failure is not retried, and a 403 is never retried.no-certificate, the same as an aborted handshake (Unknown), which told an operator with a certificate installed to install one. It is nowcertificate-not-sent, with copy saying a browser holding a certificate has likely remembered not to send it to this site and a full restart clears that, and it still shows the install instructions for the case where there is none.Authorization is unchanged: the SPA only reports what the API answered.
Merge order: independent of CryptOS-PKI/cryptos-manager#94. The retry only helps once that manager change is deployed; against an older manager it costs one extra refused request.
Closes #107
Refs: CryptOS-PKI/cryptos-manager#77
Verification
How this was verified
WhoAmIcalls; a 401 on both attempts reportscertificate-not-sentwith two calls; a permission denial is not retried; the gate renders "Certificate not sent" with the restart advice and the install instructions. The existing retry-after-denial test was updated for the second attempt.npm run lint(eslint + prettier check),npm test(291 passed),npm run build(includestsc -b) all clean.