supabase / auth-js / 12896193447

71%

push

github

feat: consider session expired with margin on getSession() without auto refresh (#1027)

When `autoRefreshToken` is off (or when a tab is in the background) but
`getSession()` is called -- such as in an active Realtime channel,
`getSession()` might return a JWT which will expire while the message is
travelling over the internet. There is one confirmed case of this
happening.

This PR adjusts this using the established `EXPIRY_MARGIN_MS` constant
(which only applies on initial initialization of the client). The
constant's value is brought in line with the `autoRefreshToken` ticks
which run every 30 seconds and refreshing is attempted 3 ticks prior to
the session expiring.

This means that JWTs with an expiry value **less than 90s** will always
refresh the session; which is acceptable.

426 of 985 branches covered (43.25%)

Branch coverage included in aggregate %.

5 of 7 new or added lines in 2 files covered. (71.43%)

724 of 1314 relevant lines covered (55.1%)

38.28 hits per line