Skip to content

Conversation

@ablause
Copy link

@ablause ablause commented Nov 4, 2025

Fixes #126

Problem

When multiple HTTP requests receive 401 responses simultaneously, each request independently triggers refreshToken, resulting in multiple concurrent refresh operations instead of a single one. While QueuedInterceptor queues incoming requests, it doesn't prevent multiple requests that are already in the error/response handlers from independently calling refreshToken. This occurs because:

  1. Multiple requests receive 401 responses nearly simultaneously
  2. Each enters onError/onResponse and calls _tryRefresh()
  3. All requests see that no refresh is in progress and each initiates a new refresh
  4. Result: refreshToken is called N times for N concurrent failed requests

Solution

This PR implements a synchronization mechanism using the synchronized package:

  1. Lock-based synchronization: Uses Lock from synchronized to ensure only one refresh operation executes at a time
  2. Token caching: Stores a reference to the last refreshed token in _latestRefreshedToken
  3. Identity check: Before refreshing, verifies if the current token is identical to the cached token using identical(). If yes, reuses it without refreshing

@ablause ablause requested a review from felangel as a code owner November 4, 2025 20:32
@NapasPayu
Copy link

@felangel could you please take a look?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Concurrent requests cause multiple token refresh events

2 participants