Any recent changes to SSE and/or authentication?

Nadahar · May 8, 2026, 12:36am

This is anecdotal, I have no hard facts, but it feels like the number of problems with failing SSE connections and authentication errors have increased significantly in my dev environment lately. They have always been there, I take it that some of it is due to me making changes, restarting bundles, using multiple browser tabs etc., but not with the frequency I’ve experienced now.

The symptoms are usually that the UI becomes unresponsive or buggy, and if I then reload the page, I must reauthenticate. My assumption is that authentication has timed out and then failed to renew, or something like that.

I’ve found stuff like this in OH’s log, but I don’t know whether it’s related to what I’m experiencing:

22:33:16.429 [WARN ] (qtp1276505738-311   ) [.io.rest.auth.internal.TokenResource] - Not refreshing token for session 8a003405-5e7b-4e64-bb23-c35d8ec3d849 of user Nadar, missing or invalid session cookie
22:33:16.429 [WARN ] (qtp1276505738-311   ) [.io.rest.auth.internal.TokenResource] - Token issuing failed: invalid_grant

In the UI, I see things like this:

…and this in the browser console:

auth?response_type=code&client_id=http%3A%2F%2Flocalhost%3A8081&redirect_uri=http%3A%2F%2Flocalhost…:1 [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://www.chromium.org/developers/design-documents/create-amazing-password-forms) <input class="field" type="password" placeholder="Passord" name="password" required>
02:30:26.667 Navigated to http://localhost:8081/?code=b48c5778a2e6469d9e6c136c817c81b2&state=d49f5e9163
02:30:26.888 client:733 [vite] connecting...
02:30:27.201 client:827 [vite] connected.
02:30:27.442 App.vue:635 sseConnected undefined
02:30:27.449 main.ts:83 App initialization: 21.00 ms
02:30:27.494 api.js:53  POST http://localhost:8081/rest/auth/token 400 (Bad Request)
(anonymous) @ request.js:406
(anonymous) @ request.js:22
(anonymous) @ api.js:53
(anonymous) @ auth-mixin.js:85
(anonymous) @ auth-mixin.js:74
created @ App.vue:957
callWithErrorHandling @ runtime-core.esm-bundler.js:199
callWithAsyncErrorHandling @ runtime-core.esm-bundler.js:206
callWithAsyncErrorHandling @ runtime-core.esm-bundler.js:217
callHook @ runtime-core.esm-bundler.js:3922
applyOptions @ runtime-core.esm-bundler.js:3839
finishComponentSetup @ runtime-core.esm-bundler.js:8206
handleSetupResult @ runtime-core.esm-bundler.js:8157
setupStatefulComponent @ runtime-core.esm-bundler.js:8126
setupComponent @ runtime-core.esm-bundler.js:8055
(anonymous) @ runtime-core.esm-bundler.js:5992
(anonymous) @ runtime-core.esm-bundler.js:5958
(anonymous) @ runtime-core.esm-bundler.js:5464
(anonymous) @ runtime-core.esm-bundler.js:6773
mount @ runtime-core.esm-bundler.js:4232
(anonymous) @ runtime-dom.esm-bundler.js:1891
(anonymous) @ main.ts:79
02:30:27.495 auth-mixin.js:99 Refreshing access token failed Bad Request
02:30:27.495 App.vue:963 Error while using the stored refresh_token to get a new access_token: Bad Request. Logging out & cleaning session.
(anonymous) @ App.vue:963
Promise.catch
created @ App.vue:962
callWithErrorHandling @ runtime-core.esm-bundler.js:199
callWithAsyncErrorHandling @ runtime-core.esm-bundler.js:206
callWithAsyncErrorHandling @ runtime-core.esm-bundler.js:217
callHook @ runtime-core.esm-bundler.js:3922
applyOptions @ runtime-core.esm-bundler.js:3839
finishComponentSetup @ runtime-core.esm-bundler.js:8206
handleSetupResult @ runtime-core.esm-bundler.js:8157
setupStatefulComponent @ runtime-core.esm-bundler.js:8126
setupComponent @ runtime-core.esm-bundler.js:8055
(anonymous) @ runtime-core.esm-bundler.js:5992
(anonymous) @ runtime-core.esm-bundler.js:5958
(anonymous) @ runtime-core.esm-bundler.js:5464
(anonymous) @ runtime-core.esm-bundler.js:6773
mount @ runtime-core.esm-bundler.js:4232
(anonymous) @ runtime-dom.esm-bundler.js:1891
(anonymous) @ main.ts:79
02:30:27.611 
02:30:27.644 prepare.js:1 🍍 "user" store installed 🆕
02:30:27.645 prepare.js:1 🍍 "components" store installed 🆕
02:30:27.645 prepare.js:1 🍍 "model" store installed 🆕
02:30:27.673 api.js:53  POST http://localhost:8081/rest/auth/logout 401 (Unauthorized)
(anonymous) @ request.js:406
(anonymous) @ request.js:22
(anonymous) @ api.js:53
(anonymous) @ auth-mixin.js:118
(anonymous) @ auth-mixin.js:111
(anonymous) @ App.vue:964
Promise.catch
created @ App.vue:962
callWithErrorHandling @ runtime-core.esm-bundler.js:199
callWithAsyncErrorHandling @ runtime-core.esm-bundler.js:206
callWithAsyncErrorHandling @ runtime-core.esm-bundler.js:217
callHook @ runtime-core.esm-bundler.js:3922
applyOptions @ runtime-core.esm-bundler.js:3839
finishComponentSetup @ runtime-core.esm-bundler.js:8206
handleSetupResult @ runtime-core.esm-bundler.js:8157
setupStatefulComponent @ runtime-core.esm-bundler.js:8126
setupComponent @ runtime-core.esm-bundler.js:8055
(anonymous) @ runtime-core.esm-bundler.js:5992
(anonymous) @ runtime-core.esm-bundler.js:5958
(anonymous) @ runtime-core.esm-bundler.js:5464
(anonymous) @ runtime-core.esm-bundler.js:6773
mount @ runtime-core.esm-bundler.js:4232
(anonymous) @ runtime-dom.esm-bundler.js:1891
(anonymous) @ main.ts:79
02:30:27.673 auth-mixin.js:126 Failed to log out Unauthorized
02:30:27.676 api.js:53  POST http://localhost:8081/rest/auth/token?useCookie=true 400 (Bad Request)
(anonymous) @ request.js:406
(anonymous) @ request.js:22
(anonymous) @ api.js:53
(anonymous) @ auth-mixin.js:49
(anonymous) @ auth-mixin.js:20
(anonymous) @ App.vue:978
onceHandler @ events-class.js:38
(anonymous) @ events-class.js:96
(anonymous) @ events-class.js:95
emit @ events-class.js:89
(anonymous) @ f7.js:73
(anonymous) @ events-class.js:96
(anonymous) @ events-class.js:95
emit @ events-class.js:89
(anonymous) @ app-class.js:267
init @ app-class.js:275
(anonymous) @ app.js:277
(anonymous) @ runtime-core.esm-bundler.js:3081
callWithErrorHandling @ runtime-core.esm-bundler.js:199
callWithAsyncErrorHandling @ runtime-core.esm-bundler.js:206
(anonymous) @ runtime-core.esm-bundler.js:3061
flushPostFlushCbs @ runtime-core.esm-bundler.js:385
flushJobs @ runtime-core.esm-bundler.js:427
Promise.then
queueFlush @ runtime-core.esm-bundler.js:322
queueJob @ runtime-core.esm-bundler.js:317
(anonymous) @ runtime-core.esm-bundler.js:6228
trigger @ reactivity.esm-bundler.js:267
endBatch @ reactivity.esm-bundler.js:325
trigger @ reactivity.esm-bundler.js:743
set @ reactivity.esm-bundler.js:1069
set @ runtime-core.esm-bundler.js:3415
(anonymous) @ App.vue:965
Promise.catch
created @ App.vue:962
callWithErrorHandling @ runtime-core.esm-bundler.js:199
callWithAsyncErrorHandling @ runtime-core.esm-bundler.js:206
callWithAsyncErrorHandling @ runtime-core.esm-bundler.js:217
callHook @ runtime-core.esm-bundler.js:3922
applyOptions @ runtime-core.esm-bundler.js:3839
finishComponentSetup @ runtime-core.esm-bundler.js:8206
handleSetupResult @ runtime-core.esm-bundler.js:8157
setupStatefulComponent @ runtime-core.esm-bundler.js:8126
setupComponent @ runtime-core.esm-bundler.js:8055
(anonymous) @ runtime-core.esm-bundler.js:5992
(anonymous) @ runtime-core.esm-bundler.js:5958
(anonymous) @ runtime-core.esm-bundler.js:5464
(anonymous) @ runtime-core.esm-bundler.js:6773
mount @ runtime-core.esm-bundler.js:4232
(anonymous) @ runtime-dom.esm-bundler.js:1891
(anonymous) @ main.ts:79
02:30:27.676 auth-mixin.js:65 Exchanging authorization code failed Bad Request
02:30:27.677 auth-mixin.js:129 Uncaught (in promise) Unauthorized
(anonymous) @ auth-mixin.js:129
Promise.catch
(anonymous) @ auth-mixin.js:125
(anonymous) @ auth-mixin.js:111
(anonymous) @ App.vue:964
Promise.catch
created @ App.vue:962
callWithErrorHandling @ runtime-core.esm-bundler.js:199
callWithAsyncErrorHandling @ runtime-core.esm-bundler.js:206
callWithAsyncErrorHandling @ runtime-core.esm-bundler.js:217
callHook @ runtime-core.esm-bundler.js:3922
applyOptions @ runtime-core.esm-bundler.js:3839
finishComponentSetup @ runtime-core.esm-bundler.js:8206
handleSetupResult @ runtime-core.esm-bundler.js:8157
setupStatefulComponent @ runtime-core.esm-bundler.js:8126
setupComponent @ runtime-core.esm-bundler.js:8055
(anonymous) @ runtime-core.esm-bundler.js:5992
(anonymous) @ runtime-core.esm-bundler.js:5958
(anonymous) @ runtime-core.esm-bundler.js:5464
(anonymous) @ runtime-core.esm-bundler.js:6773
mount @ runtime-core.esm-bundler.js:4232
(anonymous) @ runtime-dom.esm-bundler.js:1891
(anonymous) @ main.ts:79
02:30:27.712 api.js:53 XHR failed loading: POST "http://localhost:8081/rest/auth/token".
(anonymous) @ request.js:406
(anonymous) @ request.js:22
(anonymous) @ api.js:53
(anonymous) @ auth-mixin.js:85
(anonymous) @ auth-mixin.js:74
created @ App.vue:957
callWithErrorHandling @ runtime-core.esm-bundler.js:199
callWithAsyncErrorHandling @ runtime-core.esm-bundler.js:206
callWithAsyncErrorHandling @ runtime-core.esm-bundler.js:217
callHook @ runtime-core.esm-bundler.js:3922
applyOptions @ runtime-core.esm-bundler.js:3839
finishComponentSetup @ runtime-core.esm-bundler.js:8206
handleSetupResult @ runtime-core.esm-bundler.js:8157
setupStatefulComponent @ runtime-core.esm-bundler.js:8126
setupComponent @ runtime-core.esm-bundler.js:8055
(anonymous) @ runtime-core.esm-bundler.js:5992
(anonymous) @ runtime-core.esm-bundler.js:5958
(anonymous) @ runtime-core.esm-bundler.js:5464
(anonymous) @ runtime-core.esm-bundler.js:6773
mount @ runtime-core.esm-bundler.js:4232
(anonymous) @ runtime-dom.esm-bundler.js:1891
(anonymous) @ main.ts:79
02:30:27.727 api.js:53 XHR failed loading: POST "http://localhost:8081/rest/auth/logout".
(anonymous) @ request.js:406
(anonymous) @ request.js:22
(anonymous) @ api.js:53
(anonymous) @ auth-mixin.js:118
(anonymous) @ auth-mixin.js:111
(anonymous) @ App.vue:964
Promise.catch
created @ App.vue:962
callWithErrorHandling @ runtime-core.esm-bundler.js:199
callWithAsyncErrorHandling @ runtime-core.esm-bundler.js:206
callWithAsyncErrorHandling @ runtime-core.esm-bundler.js:217
callHook @ runtime-core.esm-bundler.js:3922
applyOptions @ runtime-core.esm-bundler.js:3839
finishComponentSetup @ runtime-core.esm-bundler.js:8206
handleSetupResult @ runtime-core.esm-bundler.js:8157
setupStatefulComponent @ runtime-core.esm-bundler.js:8126
setupComponent @ runtime-core.esm-bundler.js:8055
(anonymous) @ runtime-core.esm-bundler.js:5992
(anonymous) @ runtime-core.esm-bundler.js:5958
(anonymous) @ runtime-core.esm-bundler.js:5464
(anonymous) @ runtime-core.esm-bundler.js:6773
mount @ runtime-core.esm-bundler.js:4232
(anonymous) @ runtime-dom.esm-bundler.js:1891
(anonymous) @ main.ts:79
02:30:27.734 api.js:53 XHR failed loading: POST "http://localhost:8081/rest/auth/token?useCookie=true".
(anonymous) @ request.js:406
(anonymous) @ request.js:22
(anonymous) @ api.js:53
(anonymous) @ auth-mixin.js:49
(anonymous) @ auth-mixin.js:20
(anonymous) @ App.vue:978
onceHandler @ events-class.js:38
(anonymous) @ events-class.js:96
(anonymous) @ events-class.js:95
emit @ events-class.js:89
(anonymous) @ f7.js:73
(anonymous) @ events-class.js:96
(anonymous) @ events-class.js:95
emit @ events-class.js:89
(anonymous) @ app-class.js:267
init @ app-class.js:275
(anonymous) @ app.js:277
(anonymous) @ runtime-core.esm-bundler.js:3081
callWithErrorHandling @ runtime-core.esm-bundler.js:199
callWithAsyncErrorHandling @ runtime-core.esm-bundler.js:206
(anonymous) @ runtime-core.esm-bundler.js:3061
flushPostFlushCbs @ runtime-core.esm-bundler.js:385
flushJobs @ runtime-core.esm-bundler.js:427
Promise.then
queueFlush @ runtime-core.esm-bundler.js:322
queueJob @ runtime-core.esm-bundler.js:317
(anonymous) @ runtime-core.esm-bundler.js:6228
trigger @ reactivity.esm-bundler.js:267
endBatch @ reactivity.esm-bundler.js:325
trigger @ reactivity.esm-bundler.js:743
set @ reactivity.esm-bundler.js:1069
set @ runtime-core.esm-bundler.js:3415
(anonymous) @ App.vue:965
Promise.catch
created @ App.vue:962
callWithErrorHandling @ runtime-core.esm-bundler.js:199
callWithAsyncErrorHandling @ runtime-core.esm-bundler.js:206
callWithAsyncErrorHandling @ runtime-core.esm-bundler.js:217
callHook @ runtime-core.esm-bundler.js:3922
applyOptions @ runtime-core.esm-bundler.js:3839
finishComponentSetup @ runtime-core.esm-bundler.js:8206
handleSetupResult @ runtime-core.esm-bundler.js:8157
setupStatefulComponent @ runtime-core.esm-bundler.js:8126
setupComponent @ runtime-core.esm-bundler.js:8055
(anonymous) @ runtime-core.esm-bundler.js:5992
(anonymous) @ runtime-core.esm-bundler.js:5958
(anonymous) @ runtime-core.esm-bundler.js:5464
(anonymous) @ runtime-core.esm-bundler.js:6773
mount @ runtime-core.esm-bundler.js:4232
(anonymous) @ runtime-dom.esm-bundler.js:1891
(anonymous) @ main.ts:79

It’s hard for me to pinpoint what triggered the changed, because I’ve recently updated/rebased both my core and MainUI work branches. I’ve also started running the sitemap bundles, which I haven’t used to have running.

…and it could all be in my head/coincidence.

Does anybody have anything to add, any similar experiences or ideas about what might have changed?

jimtng · May 8, 2026, 1:22am

Funny you should mention this! I have noticed this recently as well! I haven’t looked into it but I’m glad it wasn’t just me.

jimtng · May 8, 2026, 1:32am

I’m not even sure I can pinpoint this to a particular build.

5.2.0-SNAPSHOT - Build #5345 (my production instance) is fine - no random log outs
Build #5351 (my test/experimentation build) seems to be fine too (so far).

But I definitely did experience this random log outs earlier.

Could this have fixed it or at least related? I haven’t looked as to when this problem started.

github.com/openhab/openhab-webui

Fix token auth on SSE reconnection (#4165)

5.1.x ← thestr4ng3r:5.1.x-states-token

opened 07:04PM - 03 May 26 UTC

thestr4ng3r

+18 -15

The headers containing the token for the SSE endpoint were initialized only once… with some initial token. On future reconnections, for example if the connection breaks this old token was still used even though it was possibly expired. In that case, the UI will show an error message and only update states again after manually pressing the reload button. This became visible for me when having the iOS app in the background for over an hour, which does not kill the app, but close the SSE connection after a while. On re-entereing the app I always saw the "Communication failed" toast of the main ui. The issue can be reproduced by opening the web ui on an instance with the implicit user role disabled in API security settings, waiting for the initially aquired token to expire and then breaking the /states SSE connection somehow (e.g. disconnecting network for a few seconds). When the main ui tries to reconnect, it will retry indefinitely with the expired token: <img width="2172" height="1090" alt="Bildschirmfoto 2026-05-03 um 20 50 57" src="https://github.com/user-attachments/assets/080f13bd-a185-451c-92e9-aea952b1d18f" /> To not have to wait an entire hour, one can use this patch on rg.openhab.core.io.rest.auth: ```diff diff --git a/bundles/org.openhab.core.io.rest.auth/src/main/java/org/openhab/core/io/rest/auth/internal/TokenResource.java b/bundles/org.openhab.core.io.rest.auth/src/main/java/org/openhab/core/io/rest/auth/internal/TokenResource.java index d3e78dca7..c34b3d43f 100644 --- a/bundles/org.openhab.core.io.rest.auth/src/main/java/org/openhab/core/io/rest/auth/internal/TokenResource.java +++ b/bundles/org.openhab.core.io.rest.auth/src/main/java/org/openhab/core/io/rest/auth/internal/TokenResource.java @@ -98,7 +98,7 @@ public class TokenResource implements RESTResource { + "=%s; Domain=%s; Path=/; Max-Age=2147483647; HttpOnly; SameSite=Strict"; /** The default lifetime of tokens in minutes before they expire */ - public static final int TOKEN_LIFETIME = 60; + public static final int TOKEN_LIFETIME = 1; private final UserRegistry userRegistry; private final JwtHelper jwtHelper; ``` This patch is for 5.1.x. I tried to reproduce this with the latest development state on main as well, but there the SSE connection did not even work on the first connection for me, so it will need some further investigation there.

which was cherry-picked into main:

github.com/openhab/openhab-webui

Fix token auth on SSE reconnection (#4165)

committed 08:41AM - 06 May 26 UTC

thestr4ng3r

+18 -15

The headers containing the token for the SSE endpoint were initialized only once… with some initial token. On future reconnections, for example if the connection breaks this old token was still used even though it was possibly expired. In that case, the UI will show an error message and only update states again after manually pressing the reload button. Signed-off-by: Florian Märkl <info@florianmaerkl.de> Signed-off-by: Florian Hotze <dev@florianhotze.com>

Nadahar · May 8, 2026, 1:51am

I have to rebase the webui again then, because this commit is not in my current branch. But, this can’t be the whole story, because something must have made it worse somewhat recently-ish.

Also, the PR author couldn’t get latest main to connect at all, and had to make the fix against 5.1. That sounds very strange.

mstormi · May 8, 2026, 10:27am

Unlikely as this wasn’t rolled out yet as part of 5.1.4.
And issues definitely started earlier.
Seeing them at times, too.

Nadahar · May 8, 2026, 11:56am

When we run dev installations, versions doesn’t matter. I choose what commit whatever I’m working on is based on, and then I have my own changes on top of that. If you’d want to try to “make it into” a version, the closest thing is one of the latest 5.2.0 snapshots.

What I think I’ve experienced is a relatively significant increase in frequency for this to occur. The problem itself isn’t new, I’ve seen it far, far back, just not very frequently.

I’ve now updated my dev code to include the above fix, and I haven’t seen the problem since. But that doesn’t have to mean anything, I haven’t done that much testing since I upgraded my branch. But, maybe it has fixed it. Even if it has, it still doesn’t explain the perceived increase in occurrence from how often it occurred earlier.

Nadahar · May 9, 2026, 2:41pm

I haven’t really experienced this since the fix, so perhaps it’s actually gone? It’s still strange how the problem seemed to get worse lately, because the fix addresses a long-standing issue, but if the problem is gone, I guess it doesn’t matter..?