Show authenticate button on 401 error

[simonw]

When the GitHub API returns a 401 (unauthorized) or 403 (forbidden) status, the tool now:

• Removes the invalid token from localStorage
• Shows the authenticate button again
• Displays an error message prompting the user to re-authenticate

This improves the user experience when tokens expire or become invalid.

---

Claude Code for web prompt:

On github-ratelimit if a 401 error occurs show the authenticate button again

[cloudflare-workers-and-pages]

Deploying tools with    Cloudflare Pages

Latest commit:	b6d8491
Status:	✅  Deploy successful!
Preview URL:	https://18104bdb.tools-b1q.pages.dev
Branch Preview URL:	https://claude-github-ratelimit-auth.tools-b1q.pages.dev

View logs

[claude]

Claude finished @simonw's task —— View job

---

Code Review Complete ✅

I've reviewed the pull request that adds proper handling for 401/403 authentication errors. Here's my comprehensive feedback:

Todo List:

• Read and analyze the changed file (github-ratelimit.html)
• Review code quality and best practices
• Check for potential bugs or issues
• Assess performance considerations
• Evaluate security concerns
• Consider test coverage

---

Code Quality and Best Practices ✅

The implementation is clean and follows good practices:

• Proper error handling: The change correctly handles HTTP 401 and 403 status codes in the checkRateLimit function (github-ratelimit.html:357-362)
• State management: Appropriately removes the invalid token from localStorage and resets the UI state
• User experience: Provides clear feedback with an error message explaining what happened
• Code structure: The error handling logic is well-integrated into the existing flow

Potential Bugs or Issues ✅

No significant bugs identified. The implementation is solid:

• Conditional logic: The status code check response.status === 401 || response.status === 403 correctly handles both unauthorized and forbidden responses
• State cleanup: localStorage.removeItem('GITHUB_TOKEN') properly removes the invalid token
• UI reset: checkGithubAuth() correctly resets the display state to show the authentication section
• Early return: The function properly returns after handling auth errors, preventing further execution

Performance Considerations ✅

The changes have minimal performance impact:

• Lightweight operations: localStorage removal and DOM manipulation are fast operations
• No new network calls: The error handling doesn't introduce additional API requests
• Efficient control flow: Early return prevents unnecessary processing when authentication fails

Security Concerns ✅

The implementation follows good security practices:

• Token cleanup: Invalid tokens are immediately removed from localStorage, preventing reuse
• No token exposure: Error messages don't leak token information
• Proper authentication flow: Forces re-authentication when tokens are invalid
• No client-side token validation: Relies on server response, which is correct

Test Coverage ❌

This is the main area for improvement. The codebase appears to lack automated tests:

• No visible test files: No test suite found for this client-side application
• Manual testing required: Authentication error scenarios should be tested manually
• Suggested test cases:
  • Simulate 401 response and verify token removal + UI reset
  • Simulate 403 response and verify same behavior
  • Test that error message displays correctly
  • Verify polling continues to work after re-authentication

Additional Recommendations

1. Consider rate limiting: The polling mechanism (startAuthPoll) runs every second indefinitely. Consider adding a timeout or max attempts.

2. Error message consistency: The error message "Authentication failed. Please authenticate again." is clear and user-friendly.

3. Graceful degradation: The implementation gracefully handles network errors and auth failures without breaking the application.

Overall Assessment

This is a high-quality defensive security improvement that properly handles authentication failures. The code is clean, secure, and follows best practices. The main weakness is the lack of automated testing, but the implementation itself is solid.

Recommendation: ✅ Approve - This change improves the user experience and security posture with minimal risk.

---