fix(realtime): end a failed socket-token attempt promptly and honor Retry-After by waleedlatif1 · Pull Request #8952 · simstudioai/sim

waleedlatif1 · 2026-10-13T02:24:26Z

Summary

When the realtime socket's auth callback can't get a token from /api/auth/socket-token (a 429 from its 30/min per-IP limit, a network error, or a 5xx), it never called cb. socket.io-client 4.8.1 sends CONNECT only from inside cb (socket.js:407-423), and the client's own 10s timeout is cleared once the transport opens (manager.js:135-170). So the attempt sat open until the realtime server's default 45s connect timeout, and users saw "Reconnecting…" the whole time. Retry-After was ignored.

Just ending the attempt early isn't enough. The Manager resets its backoff on every transport open (manager.js:306, 361-365), so it would retry about once a second forever.

The fix, for any failure other than 401:

Disconnect the socket and clear the connection state the same way the disconnect handler does. Without that, a reconnect followed by an auth failure would keep showing "connected".
Reconnect after backoffWithJitter (1s growing to 30s, the existing auth-retry constants). When the server sent Retry-After (parsed with parseRetryAfter, capped at 5 min because the route's bucket refills over 60s), wait at least that long, plus up to 20% jitter so tabs behind one IP don't retry in the same second.
Reuse the provider's existing retry timer. If the provider has unmounted, signed out or switched workspace, the !active guard means nothing gets scheduled.
The attempt counter resets on connect.

The 401 path (session gone, passes a null token, goes terminal) is unchanged. No server or rate-limit changes.

Effect: "Reconnecting…" appears after the existing 2s anti-flicker delay instead of about 45s, and the socket reconnects as soon as the backoff or Retry-After allows. During a long token-route outage, each tab retries about every 30s, compared with about every 46s before.

Verified against a real Socket.IO server with a script: the old code hangs; the new code ends the attempt promptly, waits the delay, then connects; a 401 still produces connect_error with active=false. An adversarial review checked re-entrancy, timer races, unmount and sign-out, and backoff resets. Its two findings, the stale isConnected and the jitter, are included here.

Test plan

CI type-check and lint
e2e (mobile, *): the socket-token mint check still passes

The Socket.IO auth callback never invoked cb when POST /api/auth/socket-token failed (429, 5xx, network), so the open transport sat until the realtime server's 45 s connectTimeout while the UI showed Reconnecting, and Retry-After was ignored. The client `timeout` cannot help: the Manager clears it when the transport opens, and resets its backoff on every open, so each retry ran at the 1 s floor. On a retryable mint failure, disconnect the socket and reconnect it on the existing auth backoff (1 s to 30 s, matching the reconnection config), never before the response's Retry-After. 401 keeps its cb({ token: null }) path.

…retry disconnect() on a socket that has not connected yet emits no 'disconnect' event. After a native reconnect is followed by a failed token mint, isConnected stayed true for the whole outage. Clear it, and the socket id, exactly as the 'disconnect' handler does. Spread a Retry-After-driven delay by up to +20% above the floor, so tabs behind one IP do not retry in the same second.

vercel · 2026-10-13T02:24:30Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 13, 2026 2:35am UTC

cubic-dev-ai

No issues found across 1 file

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Heads up: you’ve reached your flex budget. Increase your flex budget or wait for usage to reset.

Turn on auto-fix | Re-trigger cubic}

greptile-apps · 2026-10-13T02:29:29Z

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no blocking issues remain.

Summary

The PR ends failed socket-token attempts promptly and retries with backoff while honoring Retry-After.

Socket-token failures now end promptly and retry at the right pace.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Request socket token] --> B{Result}
  B -->|Token| C[Send connection request]
  B -->|401| D[Send null token through existing auth path]
  B -->|Other failure| E{Still the current attempt?}
  E -->|No| F[Ignore old failure]
  E -->|Yes| G[Disconnect and clear connection state]
  G --> H[Report repeated failures once]
  H --> I[Wait for backoff or Retry-After plus jitter]
  I --> A

_{Reviews (2) · Last reviewed commit: "fix(realtime): ignore token failures fro..." · Reviewed by Greptile}

…report persistent token outages

waleedlatif1 · 2026-10-13T02:35:36Z

@greptile

waleedlatif1 · 2026-10-13T02:35:37Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-13T02:35:43Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 1 file

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Heads up: you’ve reached your flex budget. Increase your flex budget or wait for usage to reset.

Turn on auto-fix | Re-trigger cubic}

waleedlatif1 added 3 commits October 12, 2026 19:19

fix(realtime): tighten the token-retry comment

ccd81ba

vercel Bot temporarily deployed to Preview October 13, 2026 02:24 Inactive

cubic-dev-ai Bot reviewed Oct 13, 2026

View reviewed changes

greptile-apps Bot reviewed Oct 13, 2026

View reviewed changes

Comment thread apps/sim/app/workspace/providers/socket-provider.tsx Outdated

Comment thread apps/sim/app/workspace/providers/socket-provider.tsx

fix(realtime): ignore token failures from a superseded handshake and …

7adc8a3

…report persistent token outages

vercel Bot temporarily deployed to Preview October 13, 2026 02:35 Inactive

cubic-dev-ai Bot reviewed Oct 13, 2026

View reviewed changes

waleedlatif1 merged commit 2008383 into staging Oct 13, 2026
40 checks passed

waleedlatif1 deleted the fix/socket-token-auth-callback branch October 13, 2026 02:43

waleedlatif1 mentioned this pull request Oct 13, 2026

fix(auth): rate-limit socket tokens per user, with an IP backstop #8958

Merged

2 tasks

TheodoreSpeaks mentioned this pull request Oct 13, 2026

v0.9.20: project membership enforcement, db and perf improvements, realtime and auth hardening, CI and test fixes #8963

Merged

Navigation Menu

Repository navigation

fix(realtime): end a failed socket-token attempt promptly and honor Retry-After - #8952

fix(realtime): end a failed socket-token attempt promptly and honor Retry-After#8952
waleedlatif1 merged 4 commits into
stagingfrom
fix/socket-token-auth-callback

waleedlatif1 commented Oct 13, 2026

Uh oh!

vercel Bot commented Oct 13, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

greptile-apps Bot commented Oct 13, 2026 •

edited

Loading

Diagram

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Oct 13, 2026

Uh oh!

waleedlatif1 commented Oct 13, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 13, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

waleedlatif1 commented Oct 13, 2026

Summary

Test plan

Uh oh!

vercel Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Diagram

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Oct 13, 2026

Uh oh!

waleedlatif1 commented Oct 13, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 13, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Oct 13, 2026 •

edited

Loading

greptile-apps Bot commented Oct 13, 2026 •

edited

Loading