- Shipped
- July 9, 2026 at 2:51 PM UTC
- Author
- kamo
- Commit
- 45478fa
The *** session moved from a shared cookie to a per-tab sessionStorage carrier (X-***-Token). A few consumers were never updated to match. - Interaction Center directory (MemberListProvider) gated its one-shot fetch on the legacy *** cookie, which is no longer set by /validate and ages out on idle -> empty directory that only a hard refresh recovered. Gate on getSessionToken() (sessionStorage), drop the meaningless 1s delay, and self-heal via a throttled refetch on focus/visibility; never blank a populated list on a transient 401. - useSmsWebSocket read *** from document.cookie and fed it to a SockJS handshake (which the fetch wrapper can't touch) -> SMS realtime silently dead per-tab. Read the sessionStorage token like every sibling hook. - sessionMonitor proactive re-extend ran on a fixed 5-min clock that collides with the 5-min warning threshold, so active users on short-timeout orgs (sessionTimeoutMinutes <= ~10) still hit the popup / got logged out. Re-extend once TTL decays below a floor safely above the warning threshold (throttled to once/min), with a one-time bootstrap extend on first load so the extend-only *** cookie (universe/ksem EventSource carrier) is still planted promptly. - SessionManager logged out an actively-working user on a single transient extend blip. Only redirect to /logout on a definitive 404/401/TTL<=0; keep the popup open on transient errors. De-bounced. - A token-less tab's 2x401 escalated to onExpired -> /logout, deleting the shared Redis session out from under other valid tabs. Treat a 401 with no sessionStorage token as "no credentials here", never as expiry.