Example threads. These questions and answers were written by the SDODS team to document real problems and how to fix them. The people named are illustrative, not real users. Questions asked on this site are marked new.
Starting a recording with --user standard drops me on the sign-in page, but the cache insists it has a good state:
sdods auth list -p rwa-bank -e local
Eighteen minutes old, and we never touched auth.maxAgeMinutes, so that is well inside the default hour. The server clearly disagrees. What decides "fresh"?
Accepted answer
Two independent checks decide it, and only one of them is the clock.
auth.maxAgeMinutes ago, which defaults to 60The second check drops expired cookies as it reads them. If the login was cookie-based and every cookie has expired, the state counts as stale even when unrelated localStorage entries survive, and it gets recaptured. That part does what you want.
The case you are in is the other one. A session cookie has no expiry — it comes back as -1 in the storage state — so there is nothing for that check to compare against and it is always kept. The server can have dropped the session thirty seconds after capture and the file still reads as valid. SDODS calls it fresh, hands it to codegen, and the app bounces you to sign-in.
So stop trusting the clock for that app. Recapture now:
sdods auth capture -p rwa-bank -e local -u standard --all --forceand put auth.maxAgeMinutes under the server's own session timeout in sdods.project.yaml. Ten is not a silly number for a demo backend.
Also check you are capturing every user of the role and not just the first. The index in <role>-<n>.json is the position within the role, and sdods auth capture defaults to --index 0, so a pool of four with one capture leaves three files missing or stale. --all does the lot.
Recording only ever uses the first user of the role, so this bites on the run rather than on the recorder — a scenario that leases standard-2 pays for a fresh login mid-suite.
Small thing that surprised us on the same trail: .auth/ is gitignored, so a clean CI checkout has none of it and the first run of the day pays for the capture. Nothing is wrong, but the extra minute shows up in the timings and somebody will ask.
Wrap commands and output in triple backticks and they will render as a code block.
Checking whether you’re signed in…
Have a different question? Ask it.