AuthInterceptor: Logout in another browser tab may leave application in inconsistent state

[saschaszott]

Describe the bug

Observed behavior

• After logging in to DSpace and opening a second browser tab, the user is also logged in there. (expected behavior)
• Logging out in one of the two tabs does not immediately affect the other tab, which still appears logged in. (expected behavior)
• However, when the user performs an action in the second tab (the one that still appears logged in), the application may get stuck in an unexpected and inconsistent state.

Expected behavior

As soon as the server responds with 401 Unauthorized (or a similar error code), the application should:
1. inform the user that a logout has occurred in another tab, and
2. immediately redirect to the login page.

Extend the existing AuthInterceptor so that it catches 401 responses and triggers a consistent logout flow (including redirecting to /login). This will ensure that the application does not remain in an inconsistent intermediate state.

Steps to reproduce:
1. Log in as submitter to DSpace Demo
2. Open a second browser tab → user is also logged in there
3. Log out in one of the two tabs
4. In the other tab, perform an action (e.g., navigate to MyDSpace > Workflow tasks)

Result: the application may remain in an unexpected state as you can see in the screenshot

The same behavior also occurs in the opposite scenario:

• When two browser tabs are open and the user is not logged in,
• then the user logs in successfully in one tab,
• the second tab does not reflect the login state, even if further UI actions are performed there.
• Only after a full page reload in the second tab the application recognize that the user is logged in.

[saschaszott]

If the user changes the UI language in the tab that has not yet recognized the logout, the application does in fact recognize that the user is no longer logged in (which is the expected behavior).

The same (correct) behavior can be observed with two tabs during login in one tab. If, in the other tab (which has not yet recognized the login), the UI language is changed, the application then detects (without a full page reload) that a successful login has occurred in the other tab.

[saschaszott]

@ybnd , is this somehow related to #4662 ?

[jlipka]

@saschaszott We developed a solution for our DSpace instance to address this issue. We encountered an inconsistent login state across multiple tabs, resulting in data loss when subscription forms were edited in one of these tabs. If I can find the time tomorrow, I will try to provide a Git patch file based on the current 'main' or 'dspace8' branch. Unfortunately, I can't make any promises at the moment as I'm going off on holiday tomorrow.

[saschaszott]

@jlipka , thank you!