I’ve been running snapshot builds for a long time and have been seeing an issue where MainUI frequently logs me out and forces a re‑login. I’m not sure exactly when it started, possibly even before 5.2, but it has been happening consistently across multiple recent snapshots, including the one I’m on now (updated within the past week).
The logs show repeated authentication‑related warnings at the moment the UI session drops:
19:26:55.275[WARN] [org.openhab.core.io.rest.auth.internal.TokenResource] - Not refreshing token for session f0a452c8-f3e8-41a5-b805-41e46c2a770e of user foo, missing or invalid session cookie
--
19:26:55.275[WARN] [org.openhab.core.io.rest.auth.internal.TokenResource] - Token issuing failed: invalid_grant
19:26:56.265[WARN] [org.openhab.core.io.rest.auth.AuthFilter] - Unauthorized API request from 192.168.1.234: Error while processing JWT token
The symptom is usually that MainUI suddenly stops behaving normally — something odd happens in the interface. When I refresh the page, it immediately redirects to the login screen. After logging back in, everything works again for a while until it happens again.
This isn’t a recent regression; it has been happening for well over a year across many snapshot builds. The logs consistently show invalid_grant, “missing or invalid session cookie”, and JWT‑related warnings when the session drops, which suggests an issue somewhere in the authentication/token‑refresh path.
I’m not sure whether this is a core bug or a MainUI bug. I’ve never investigated it properly because it always happens while I’m in the middle of something else and I just log back in and continue.
yeah that invalid_grant + missing session cookie loop is annoying. ive seen it when the browser is dropping the refresh cookie (safari / strict tracking, or mainui on http behind a reverse proxy that strips Set-Cookie).
things that calmed it for me:
same origin for the ui (no mixing http ui with https reverse proxy cookies)
try a clean browser profile once, or disable “block third party cookies” for that host
check if youre hitting mainui through myopenhab vs local lan, those sessions behave differently
if it only happens on one browser, its probably cookie policy not core. if every client drops the same way, then yeah token refresh path. paste whether local http or reverse-proxied https?
I use Edge as my main browser so I’ve only noticed it with Edge. I shall try using a different browser for openhab work to see if it ever happens there.
Direct http (not https) connection on LAN, not myopenhab. I access it with direct ip address http://192.168.x.x:8484/
There is a small possibility that it’s Edge’s fault. Occasionally (maybe every week or two?) Edge cannot open github, and a restart of Edge fixed that. However, the openhab logout happens far more often than that. Multiple times a day, almost every day that I’m tinkering with openhab.
I also work with multiple openhab instances on different ports, but with the same browser.
So perhaps it’s because the browser puts inactive tabs to sleep.
The fix needs to be done in core. MainUI needs to be tweaked to gracefully show the login page when this occurred instead of just acting weird on whatever page the user is currently on.
Maybe related. I have generic setup without token use. On safari (ipad) it used to get a message to Reload, but it reloaded by itself. Since OH5.2 I actually have to click the reload button. Not a big deal or a problem for me, but does indicate something was changed.
