Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Embedded vaadin flow component disappears after session timeout and also loads styles from wrong location. #19620

Closed
ggecy opened this issue Jun 20, 2024 · 7 comments · Fixed by #20407

Comments

@ggecy
Copy link

ggecy commented Jun 20, 2024

Description of the bug

I have a vaadin flow component exported through WebComponentExporter and embedded in another page. When I e.g. let the laptop sleep for longer than session timeout duration or just put the browser to offline in Network tab in Developer tools, the server session expires in meantime and the embedded component disappears from page - it's still there in html source, but with nothing inside its shadow-root except one style element. I managed to replicate it also with latest skeleton starter application downloaded from vaadin.com where I just added the WebComponentExporter for the sample view, added cors filter bean registration and set the servlet session timeout to 60 seconds. After waiting for over 60 seconds in offline mode and then disabling offline mode the embedded component tries to resynchronize on next heartbeat or any other request to server and then disappears.

Also the embedded component tries to incorretly download styles from wrong host - my vaadin flow app is running on port 8080 and the embedded components tries to load styles from the page where it is embedded instead.

Browser console log: localhost-1718905756488.log

Screenshot 2024-06-20 at 19 50 37

Expected behavior

Embedded flow component should not dissapear after server session expires.
Styles should be loaded from correct url.

Minimal reproducible example

See https://github.com/ggecy/embedded-component-issues

  1. Clone the repo, build and start the vaadin application. I changed the session timeout to 60 seconds and heartbeat to 15 seconds. There is also cors filter registration bean to add cors headers. I also added WebComponentExporter for sample view.
  2. In react-app subfolder, I created a blank react app where in public/index.html I added the embedded webcomponent. Go to this subfolder and run npm install and then npm run start to start the app on port 3000.
  3. Open the http://localhost:3000 in chrome, the page should open with embedded component displayed. Open developer tools and in Network tab at the top choose Offline from throttling menu.
  4. Wait for longer than 60 seconds until session expires on backend.
  5. Change offline mode back to no thottling.
  6. The embedded component should try to resynchronize with server on next heartbeat or when you try to submit a value from textfield.
  7. Embedded component disappears.

Versions

  • Vaadin / Flow version: 24.4.3
  • Java version: 17
  • OS version: MacOS 14.5
  • Browser version (if applicable): Arc 1.47.1 (latest)
  • IDE (if applicable): Intellij Idea Ultimate
@ggecy
Copy link
Author

ggecy commented Jun 22, 2024

It seems that during resynchronize, some code tries to set the exported web component $server.disconnected function while $server is undefined, it seems to be this place:

elem.$server.disconnected = function(){} // mock disconnected callback not to throw TypeError

@TatuLund
Copy link
Contributor

@ggecy
Copy link
Author

ggecy commented Jul 25, 2024

Any updates? This has been under investigation for over a month now...

@AlainaFaisal AlainaFaisal moved this from 🔎 Investigation to 🔖 Normal Priority (P2) in Vaadin Flow bugs & maintenance (Vaadin 10+) Jul 25, 2024
@mshabarov mshabarov moved this to 🪵Product backlog in Vaadin Flow ongoing work (Vaadin 10+) Aug 5, 2024
@mshabarov mshabarov moved this from 🔖 Normal Priority (P2) to 🔖 High Priority (P1) in Vaadin Flow bugs & maintenance (Vaadin 10+) Aug 5, 2024
@mshabarov
Copy link
Contributor

No updates unfortunately, we have no solution at the moment, but will be keeping an eye on it and continue as soon as we can.

@pmneo
Copy link

pmneo commented Oct 9, 2024

I'm struggling with the same issue.

Is there any possiblity to remove or shutdown a web component completely, without reloading the page?

Thanks

@mshabarov mshabarov added Impact: High embedding flow Issues for embedding Flow applications and removed Impact: Low labels Oct 9, 2024
@mshabarov mshabarov moved this from 🪵Product backlog to 🟢Ready to Go in Vaadin Flow ongoing work (Vaadin 10+) Oct 16, 2024
@caalador caalador self-assigned this Oct 23, 2024
@caalador
Copy link
Contributor

caalador commented Oct 23, 2024

What I found is that there is something happening when Push is in use. So if I do not have Push enabled the resync works, but with push enabled there are 2 webcomponent-resync calls which breaks the webcomponent.

So as a workaround one can use polling from the webcomponent instead of push while we try to get a fix for the problem with push.

@caalador caalador removed their assignment Nov 1, 2024
mcollovati added a commit that referenced this issue Nov 5, 2024
After session expiration, Flow client in webcomponent mode send a GET request
to the server to re-initialize itself with a valid session cookie.
However, the XHR call is done with the withCredentials flag set to false,
making the browser ignore the Set-Cookie header in the response.
This change forces the withCredential flag to true for resync request
so that the new cookie can be handled by the browser and reused in the
subsequent request that re-intitializes the embedded component.

Fixes #19620
mcollovati added a commit that referenced this issue Nov 7, 2024
After session expiration, Flow client in webcomponent mode send a GET request
to the server to re-initialize itself with a valid session cookie.
However, the XHR call is done with the withCredentials flag set to false,
making the browser ignore the Set-Cookie header in the response.
This change forces the withCredential flag to true for resync request
so that the new cookie can be handled by the browser and reused in the
subsequent request that re-intitializes the embedded component.
If PUSH is enabled, it also restores the connection after resynchornization
request to make sure pending invocation queue, and especially the
webcomponent connected events, can be flushed correctly and sent to the
server.
Also temporarily suspends hearbeat during resynchronization request to prevent
issue with concurrent requests, potentially causing duplicated session
expiration handling on the client.

Fixes #19620
@mcollovati mcollovati self-assigned this Nov 8, 2024
mshabarov pushed a commit that referenced this issue Nov 11, 2024
* fix: reconnect web components after session expiration

After session expiration, Flow client in webcomponent mode send a GET request
to the server to re-initialize itself with a valid session cookie.
However, the XHR call is done with the withCredentials flag set to false,
making the browser ignore the Set-Cookie header in the response.
This change forces the withCredential flag to true for resync request
so that the new cookie can be handled by the browser and reused in the
subsequent request that re-intitializes the embedded component.
If PUSH is enabled, it also restores the connection after resynchornization
request to make sure pending invocation queue, and especially the
webcomponent connected events, can be flushed correctly and sent to the
server.
Also temporarily suspends hearbeat during resynchronization request to prevent
issue with concurrent requests, potentially causing duplicated session
expiration handling on the client.

Fixes #19620

* add tests
@github-project-automation github-project-automation bot moved this from 🟢Ready to Go to Done in Vaadin Flow ongoing work (Vaadin 10+) Nov 11, 2024
vaadin-bot pushed a commit that referenced this issue Nov 11, 2024
* fix: reconnect web components after session expiration

After session expiration, Flow client in webcomponent mode send a GET request
to the server to re-initialize itself with a valid session cookie.
However, the XHR call is done with the withCredentials flag set to false,
making the browser ignore the Set-Cookie header in the response.
This change forces the withCredential flag to true for resync request
so that the new cookie can be handled by the browser and reused in the
subsequent request that re-intitializes the embedded component.
If PUSH is enabled, it also restores the connection after resynchornization
request to make sure pending invocation queue, and especially the
webcomponent connected events, can be flushed correctly and sent to the
server.
Also temporarily suspends hearbeat during resynchronization request to prevent
issue with concurrent requests, potentially causing duplicated session
expiration handling on the client.

Fixes #19620

* add tests
vaadin-bot pushed a commit that referenced this issue Nov 11, 2024
* fix: reconnect web components after session expiration

After session expiration, Flow client in webcomponent mode send a GET request
to the server to re-initialize itself with a valid session cookie.
However, the XHR call is done with the withCredentials flag set to false,
making the browser ignore the Set-Cookie header in the response.
This change forces the withCredential flag to true for resync request
so that the new cookie can be handled by the browser and reused in the
subsequent request that re-intitializes the embedded component.
If PUSH is enabled, it also restores the connection after resynchornization
request to make sure pending invocation queue, and especially the
webcomponent connected events, can be flushed correctly and sent to the
server.
Also temporarily suspends hearbeat during resynchronization request to prevent
issue with concurrent requests, potentially causing duplicated session
expiration handling on the client.

Fixes #19620

* add tests
vaadin-bot added a commit that referenced this issue Nov 12, 2024
…24.4) (#20440)

* fix: reconnect web components after session expiration (#20407)

* fix: reconnect web components after session expiration

After session expiration, Flow client in webcomponent mode send a GET request
to the server to re-initialize itself with a valid session cookie.
However, the XHR call is done with the withCredentials flag set to false,
making the browser ignore the Set-Cookie header in the response.
This change forces the withCredential flag to true for resync request
so that the new cookie can be handled by the browser and reused in the
subsequent request that re-intitializes the embedded component.
If PUSH is enabled, it also restores the connection after resynchornization
request to make sure pending invocation queue, and especially the
webcomponent connected events, can be flushed correctly and sent to the
server.
Also temporarily suspends hearbeat during resynchronization request to prevent
issue with concurrent requests, potentially causing duplicated session
expiration handling on the client.

Fixes #19620

* add tests

* fix pom files

---------

Co-authored-by: Marco Collovati <[email protected]>
vaadin-bot added a commit that referenced this issue Nov 12, 2024
…24.5) (#20439)

* fix: reconnect web components after session expiration (#20407)

* fix: reconnect web components after session expiration

After session expiration, Flow client in webcomponent mode send a GET request
to the server to re-initialize itself with a valid session cookie.
However, the XHR call is done with the withCredentials flag set to false,
making the browser ignore the Set-Cookie header in the response.
This change forces the withCredential flag to true for resync request
so that the new cookie can be handled by the browser and reused in the
subsequent request that re-intitializes the embedded component.
If PUSH is enabled, it also restores the connection after resynchornization
request to make sure pending invocation queue, and especially the
webcomponent connected events, can be flushed correctly and sent to the
server.
Also temporarily suspends hearbeat during resynchronization request to prevent
issue with concurrent requests, potentially causing duplicated session
expiration handling on the client.

Fixes #19620

* add tests

* fix pom files

---------

Co-authored-by: Marco Collovati <[email protected]>
@vaadin-bot
Copy link
Collaborator

This ticket/PR has been released with Vaadin 24.6.0.alpha3 and is also targeting the upcoming stable 24.6.0 version.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

Successfully merging a pull request may close this issue.

8 participants