From 09d2451f2c6d8b6b693e16d1126bc3534dc2891e Mon Sep 17 00:00:00 2001 From: Krystie Date: Wed, 22 Jul 2026 01:43:59 -0700 Subject: [PATCH] DC-XXX: add AbortSignal timeouts to auto-login page JS, kill hang buildLoginPage() in routes/auth/sso-gate.js shipped with bare fetches (no signal). When app-token/:serviceId hung in the browser (slow upstream, no response after 30s+, etc.), the page sat on 'Signing in to Plex...' indefinitely. Verified on DNS2 2026-07-22: user reported 'still doing the same thing' even after cookie + XFF fixes were verified working end-to-end. Hardening: - check-session fetch: 5s AbortSignal timeout - app-token/:svc fetch (via ft()): 8s AbortSignal timeout - 15s hard overall timer: if nothing succeeds, force-redirect to status.sami?auth=required so the user can re-auth - try/catch around fail() to prevent DOM exception from breaking flow Verified live: 133/133 auth/sso/csrf/session tests pass; container healthy; served page contains 'withTimeout' + 'overallTimer' + '15000'. Auto-login can no longer hang the page. --- dashcaddy-api/routes/auth/sso-gate.js | 44 ++++++++++++++++----------- 1 file changed, 27 insertions(+), 17 deletions(-) diff --git a/dashcaddy-api/routes/auth/sso-gate.js b/dashcaddy-api/routes/auth/sso-gate.js index e43317f..ef5e64c 100644 --- a/dashcaddy-api/routes/auth/sso-gate.js +++ b/dashcaddy-api/routes/auth/sso-gate.js @@ -222,23 +222,33 @@ function buildLoginPage(service) { // session and we render the auto-login body; if 401, the meta-refresh kicks // in and sends them to status.sami to authenticate first. const SHELL = (body) => ` -__TITLE__ - -

__TITLE__

-`; + __TITLE__ + +

__TITLE__

+ `; const pages = { chat: {