Bug 2025534 Comment 0 Edit History

Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.

Original comment by
on 
Felt should be the responsible party to handle signin/signout/refresh/re-auth logic, Firefox should hand off any responsibility to Felt.

* Only Felt holds the refresh token and sends access token and expiry to Firefox.
* If Firefox feels the need to refresh the token, either by getting 401 responses from the backend or hitting the expiry time, It sends a `RefreshTokens` IPC message to Felt to refresh the token:
  * In the happy case, Felt refreshes the token and sends a `AccessToken((<token>, <expires_at>))` IPC message back to Firefox. Firefox stores those in memory and normal work continues.
  * If for any reason, the refresh fails (user has been deactivated, refresh token timed out, …), Felt sends a `LogoutShutdown` IPC message to Firefox. Felt deletes all tokens it possesses, sets itself visible and to the foreground and displays the sign in screen - essentially a fresh start.

This limits the IPC messages to these:

Ask for a token refresh
Firefox -> `RefreshTokens` -> Felt

Set a new access token in Firefox
Felt -> `AccessToken((<token>, <expires_at>))` -> Firefox

Exit Firefox
Felt -> `LogoutShutdown` -> Firefox
Revision 1 by
on 
Felt should be the responsible party to handle signin/signout/refresh/re-auth logic, Firefox should hand off any responsibility to Felt.

* Only Felt holds the refresh token and sends access token and expiry to Firefox.
* If Firefox feels the need to refresh the token, either by getting 401 responses from the backend or hitting the expiry time, It sends a `RefreshTokens` IPC message to Felt to refresh the token:
  * In the happy case, Felt refreshes the token and sends a `AccessToken((<token>, <expires_at>))` IPC message back to Firefox. Firefox stores those in memory and normal work continues.
  * If for any reason, the refresh fails (user has been deactivated, refresh token timed out, …), Felt sends a `LogoutShutdown` IPC message to Firefox. Felt deletes all tokens it possesses, sets itself visible and to the foreground and displays the sign in screen - essentially a fresh start.

This limits the IPC messages to these:

Ask for a token refresh
Firefox -> `RefreshTokens` -> Felt

Set a new access token in Firefox
Felt -> `AccessToken((<token>, <expires_at>))` -> Firefox

Sign Out
Firefox -> `LogoutShutdown` -> Felt
Revision 2 by
on 
Felt should be the responsible party to handle signin/signout/refresh/re-auth logic, Firefox should hand off any responsibility to Felt.

* Only Felt holds the refresh token and sends access token and expiry to Firefox.
* If Firefox feels the need to refresh the token, either by getting 401 responses from the backend or hitting the expiry time, It sends a `RefreshTokens` IPC message to Felt to refresh the token:
  * In the happy case, Felt refreshes the token and sends a `AccessToken((<token>, <expires_at>))` IPC message back to Firefox. Firefox stores those in memory and normal work continues.
  * If for any reason, the refresh fails (user has been deactivated, refresh token timed out, …), Felt deletes all tokens it possesses, sets itself visible and to the foreground and displays the sign in screen - essentially a fresh start. Once the auth flow succeeds, Firefox is passed the new token and brought to the foreground.

This limits the IPC messages to these:

Ask for a token refresh
Firefox -> `RefreshTokens` -> Felt

Set a new access token in Firefox
Felt -> `AccessToken((<token>, <expires_at>))` -> Firefox

Sign Out
Firefox -> `LogoutShutdown` -> Felt

Back to Bug 2025534 Comment 0