Skip to content

Handle SSE token expiration silently to avoid Sentry noise#19060

Closed
jnMetaCode wants to merge 1 commit intotwentyhq:mainfrom
jnMetaCode:fix/sse-token-expiry-silent-18077
Closed

Handle SSE token expiration silently to avoid Sentry noise#19060
jnMetaCode wants to merge 1 commit intotwentyhq:mainfrom
jnMetaCode:fix/sse-token-expiry-silent-18077

Conversation

@jnMetaCode
Copy link
Copy Markdown

Summary

  • Fixes the SSE client error handler in useTriggerEventStreamCreation to detect token expiration errors (401/UNAUTHENTICATED) and handle them silently by triggering event stream reconnection
  • Non-token-expiration errors continue to be reported to Sentry as before
  • This prevents excessive Sentry error logs caused by normal idle session token expiry, which is a standard reconnection scenario

Fixes #18077

Test plan

  • Verify that when a session goes idle and the token expires, no error is sent to Sentry
  • Verify that the SSE client reconnects normally after token expiration
  • Verify that genuine SSE errors (non-auth) are still captured in Sentry

When a user session is idle long enough for the token to expire, the SSE
client's error callback was sending every error to Sentry. This is a
normal reconnection scenario and should not produce error logs. The fix
detects token expiration errors (401/UNAUTHENTICATED) and silently
triggers event stream destruction for reconnection, only reporting
unexpected errors to Sentry.

Fixes twentyhq#18077
Copy link
Copy Markdown
Contributor

@greptile-apps greptile-apps bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

@github-actions
Copy link
Copy Markdown
Contributor

Welcome!

Hello there, congrats on your first PR! We're excited to have you contributing to this project.
By submitting your Pull Request, you acknowledge that you agree with the terms of our Contributor License Agreement.

Generated by 🚫 dangerJS against b7fb1e9

Copy link
Copy Markdown
Contributor

@cubic-dev-ai cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 1 file

Comment on lines +127 to +130

return;
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The new 401 error handler triggers an infinite SSE reconnection loop because it does not refresh the expired authentication token before attempting to reconnect.
Severity: HIGH

Suggested Fix

Instead of silently triggering a reconnection on a 401 error, the handler should initiate a token refresh mechanism or trigger a user-facing re-authentication flow. The reconnection should only proceed after the token has been successfully refreshed. Persistent authentication failures should be logged to ensure visibility.

Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location:
packages/twenty-front/src/modules/sse-db-event/hooks/useTriggerEventStreamCreation.ts#L127-L130

Potential issue: When the authentication token expires, the SSE client receives a 401
error. The new error handler in `useTriggerEventStreamCreation.ts` catches this and sets
`shouldDestroyEventStreamState` to `true`, initiating a destroy-and-recreate cycle for
the event stream. However, the client-side application lacks a mechanism to
automatically refresh the expired token. Consequently, the new SSE stream is created
with the same invalid token, leading to another 401 error. This results in a silent,
infinite reconnection loop, consuming client and server resources without notifying the
user of the session expiration or logging the error.

Did we get this right? 👍 / 👎 to inform future reviews.

@charlesBochet
Copy link
Copy Markdown
Member

@jnMetaCode Please stop opening AI generated PR on this repository. You are not helping us and harming the community. This will be the only warning before ban: one more and that's it

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Avoid SSE token expired error if reconnecting normally

2 participants