← All questions

auth list says the cached state is fresh but the recording opens logged out

29votes

Starting a recording with --user standard drops me on the sign-in page, but the cache insists it has a good state:

bashCopy

sdods auth list -p rwa-bank -e local

Eighteen minutes old, and we never touched auth.maxAgeMinutes, so that is well inside the default hour. The server clearly disagrees. What decides "fresh"?

recordingconfigdata

RKasked by Renata Kohl608 · 11 Apr 2023

3 answers

• 38votes✓

  Accepted answer

  Two independent checks decide it, and only one of them is the clock.

  • the sidecar beside the state file has to say the capture happened less than auth.maxAgeMinutes ago, which defaults to 60
  • the state file itself has to still contain something usable — a cookie whose expiry has not passed, or a localStorage entry

  The second check drops expired cookies as it reads them. If the login was cookie-based and every cookie has expired, the state counts as stale even when unrelated localStorage entries survive, and it gets recaptured. That part does what you want.

  The case you are in is the other one. A session cookie has no expiry — it comes back as -1 in the storage state — so there is nothing for that check to compare against and it is always kept. The server can have dropped the session thirty seconds after capture and the file still reads as valid. SDODS calls it fresh, hands it to codegen, and the app bounces you to sign-in.

  So stop trusting the clock for that app. Recapture now:

  bashCopy

  sdods auth capture -p rwa-bank -e local -u standard --all --force

  and put auth.maxAgeMinutes under the server's own session timeout in sdods.project.yaml. Ten is not a silly number for a demo backend.

  PVanswered by Priya Venkateshmaintainer29,604 · 11 Apr 2023
• 11votes

  Also check you are capturing every user of the role and not just the first. The index in <role>-<n>.json is the position within the role, and sdods auth capture defaults to --index 0, so a pool of four with one capture leaves three files missing or stale. --all does the lot.

  Recording only ever uses the first user of the role, so this bites on the run rather than on the recorder — a scenario that leases standard-2 pays for a fresh login mid-suite.

  AOanswered by Ade Oyinlola419 · 12 Apr 2023
• 4votes

  Small thing that surprised us on the same trail: .auth/ is gitignored, so a clean CI checkout has none of it and the first run of the day pays for the capture. Nothing is wrong, but the extra minute shows up in the timings and somebody will ask.

  MKanswered by Marijn Kuiper18,840 · 18 Apr 2023