How to handle Session Expiry in ServiceWorker

Question

EDIT 1

One thing I didn't make clear in my use case was that the browser DOES NOT need to show the UX to authenticate, or at least it's optional.

    var credential = await navigator.credentials.get({
            password: true,  
            mediation: "silent",
            federated: {providers: federatedProviderURL}}
        );

If the user has logged off or removed passwords from the UA then it will fail (credential == null).

The credential spec writers may stipulate that, if called from ServiceWorker, mediation must be "silent" or, if otherwise and no UI available an: -

Error - NOUI Action requires UI to complete

But the important point here is in the vast majority of cases keyless re-authentication can take place.

Does that change things at all?

Cheers Richard

ORIGINAL POST: -

If a Fetch in my ServiceWorker receives a 401 from the server how do I re-authenticate with the server if I have no focused or foregrounded client?

NB: I'm talking about POST requests updating the server and not just reading from cache until the network is back.

Bring the client back into focus? Scary for user with no action causing that reaction and they may not be there to login again anyway.

What does Background-Synch do if it gets a 401?

If navigator.credentials was surfaced in a ServiceWorker that would be enough!

Sessions that never expire?

What are other people doing?

Yet again I'm banned from W3C/IETF Github :-(

If someone could add the following to ServiceWorker issues that would help: - Please see Use-Case

If a User Session has expired a ServiceWorker currently has no mechanisms available to re-authenticate with the server as there is no heuristic mechanism available for determining credentials.

If the credentials.get() was available then re-authentication could take place transparently. If federated (say Google) then if the user had logged out then that state would be honoured.

Answer 1

It seems there has been discussion on this before. Please see GitHub

I think that background re-authenticating should be infrequent enough that a notification of the sign-in or failure is an appropriate and user-friendly solution.

Please comment over there if you have any ideas!