mirror of
https://github.com/SigNoz/signoz.git
synced 2026-09-27 13:50:41 +01:00
e8324581b3
Some checks failed
build-staging / prepare (push) Has been cancelled
build-staging / js-build (push) Has been cancelled
build-staging / go-build (push) Has been cancelled
build-staging / staging (push) Has been cancelled
cacheci / tests (push) Has been cancelled
Release Drafter / update_release_draft (push) Has been cancelled
#### Description - `Token.Rotate` accepted the previous token pair only when the rotation was older than `rotation.duration` and rejected it inside the window, the inverse of the documented intent. - With the opaque tokenizer, two holders of the same pair (browser tabs, the axios interceptor and the SSE wrapper) racing at the rotation boundary meant the loser got 401 on `/sessions/rotate` and the frontend logged the user out. It also left a stale pair exchangeable for the live session until the next rotation. - `RotateToken` now detects that `Rotate` left the stored row untouched and returns the current pair without rewriting it; the previous check compared against the input and could never match. - Adds a unit test for the previous-pair path inside and outside the window. #### Additional Information The JWT tokenizer is unaffected since its rotation is stateless.