WebUI randomly refreshes without being prompted to about syncthing HOT 15 CLOSED

Anything logged in the browser console or happening request wise?

from syncthing.

Not much; when the page refresh occurs, all I get is:

For comparison, a normal (manual) page refresh looks like this:

from syncthing.

On my third affected device (my OpenWRT router), since I not accessing the web UI through the machine itself, but rather over the network via my Linux system, the behaviour is different. Instead of reloading, the page shows a connection error (as if the daemon was shut down). The browser console then looks like this:

The daemon however is not actually down, as I am able to manually reload the page to get the WebUI to work again. Not as bad as outright discarding any pending changes, but still annoying.

from syncthing.

I'd try a different browser or disable some plugins

from syncthing.

I just tested on a clean installation of ungoogled chromium. The issue still occurs on the local machine's WebUI, but doesn't seem to appear on the remote WebUI.

from syncthing.

I don't think we do anything special depending on whether it's viewed locally or from a remote machine, so that still sounds like something specific to that machine.

Try running syncthing on the other machine and see if you can reproduce that locally.

from syncthing.

It's noteworthy that the event XHR request fails because of 403 Forbidden,

which causes the page to reload https://github.com/syncthing/syncthing/blob/main/gui/default/syncthing/core/eventService.js#L44

from syncthing.

Hm. Maybe it's cookie related?

from syncthing.

I initially thought it was, because uMatrix had disabled cookies for the WebUI. However the issue still happens:

• with cookies enabled on uMatrix
• with uMatrix turned off
• with the uMatrix addon completely disabled
• with the fresh install of ungoogled Chromium (which has no addons)

I might've missed a test case, but I suspect it's probably not cookie related.

Another finding from looking at the network graph of the remote WebUI is that the endpoint request eventually fails with "CSRF Error", triggering a page reload (likely via the file @valaphee posted).

from syncthing.

That cookie warning looks suspicious.

from syncthing.

This might be related to #7399. Maybe Chromium is a bit more strict?

from syncthing.

Huh. In that case, maybe the CSRF Cookie expires after a while, which causes the backend to return 403 when Syncthing attempts to do a periodic update, and that in turn causes the page to reload.

In which case: is this an intended feature? And can it be turned off?

from syncthing.

"csrf error" typically just means auth error, doesn't need to be the csrf specifically. I suspect something yeeting the auth cookie.

from syncthing.

We're not setting the SameSite attribute for the CSRF-TOKEN-XXXXXXX and sessionid-XXXXXX cookies. Maybe Ungoogled Chromium is a bit more strict in that regard?

Not sure if this intended or not, but the CSRF cookie is also missing the Secure attribute.

from syncthing.

Update on my situation:

about a month ago I decided to change the GUI listen address across my desktop and laptop. Additionally I went ahead and cleared my page cookies after I had everything set up, to make sure I was starting out in a relatively fresh state. So far the issue hasn't come up again, but I don't know what ultimately fixed it...

If it really was cookies, then that wouldn't explain why the issue appeared on a completely fresh browser with a brand new user profile. But then again, I don't know what else to pin it on. In any case, glad it's resolved for now.

On an unrelated note, thank you all for working on this project. I didn't think to say it last time, and I worry it didn't come across due to the nature of the conversation, but I genuinely appreciate having Syncthing in my life (especially as a dev).

from syncthing.