Logging out when there are multiple AngularJS staff client tabs open can cause problems

[Galen Charlton]

Because of the way that the AngularJS staff client handles BroadcastChannel messages on the eg.auth channel that are sent when another tab (either Angular or AngularJS) gets a request to log out, it is possible for multiple browser tabs that have the AngularJS staff client open to fall into a broadcast storm of logout messages on the eg.auth channel. Any Angular staff tabs that are also present will attempt to handle each and every message by running a running an open-ils.auth.session.delete. This can happen fast enough that thousands of open-ils.auth.session.delete requests can be made by a single browser, in the space of a few minutes, overwhelming the open-ils.auth service and preventing session creation and verification.

Empirically, opening four or five open AngularJS tabs, then logging out of one, is sufficient to reproduce the problem.

Note that it is STRONGLY recommended to test this only on personal and isolated Evergreen systems.

Evergreen 3.8+

[Galen Charlton (gmc)]

A patch is available in the branch working/user/gmcharlt/lp2034617_improve_logout_handling / https://git.evergreen-ils.org/?p=working/Evergreen.git;a=shortlog;h=refs/heads/user/gmcharlt/lp2034617_improve_logout_handling

I think this patch is a candidate for a quick fix, but additional work would be useful to:

- have the Angular app stop listening to eg.auth messages after it receives the first 'logout' message (then resume once the user has logged in again)
- tighten up the logic around when the AngularJS expired auth handler sends the broadcast message

[Galen Charlton (gmc)]

This bug is presumably related to bug 2002693.

[Jason Boyer (jboyer)]

Between my own testing and multiple customers using this patch over the last several months, my signoff is here: https://git.evergreen-ils.org/?p=working/Evergreen.git;a=shortlog;h=refs/heads/user/jboyer/lp2034617_ajs_logout_signoff / working/user/jboyer/lp2034617_ajs_logout_signoff

[Jeff Davis (jdavis-sitka)]

I haven't been able to replicate the server-side issue in a test environment, but the fix appears to prevent my browser from freezing when logging out with multiple tabs open. Pushed to rel_3_11, rel_3_12, and main. Thanks, Galen and Jason!