429 Too many requests: Concurrent signOut.

[sorozco653]

Describe the bug

I am trying to debug a 429 issue that we are currently facing. Our users typically have many tabs open, and if they have more than six tabs, we get rate-limited when they signOut due to too many concurrent requests.

As a result, we had to disable syncStorage to mitigate the 429 errors. However, this has led to a token request being sent from each tab. What is the best way to handle SSO logout when multiple tabs are open, without getting rate-limited, while keeping syncStorage enabled?

We use localStorage for our storage manager and auto renew enabled

Reproduction Steps?

1. Open many tabs (6+)
2. signOut of the application
3. The six tab gets rate limited

SDK Versions

"@okta/okta-angular": "^6.4.0",
"@okta/okta-auth-js": "^7.10.1",

Additional Information?

No response

[jaredperreault-okta]

I am trying to debug a 429 issue that we are currently facing. Our users typically have many tabs open, and if they have more than six tabs, we get rate-limited when they signOut due to too many concurrent requests.

Can you expand more on the original issue? Which endpoint is resulting in 429s?

[sorozco653]

It appears that the issue is with the /authorize endpoint. When a user clicks on okta.signOut, I notice that the revoke calls are being executed in only one tab. This action triggers all tabs to log out simultaneously. Consequently, all tabs are redirected to a post-logout route, which is a protected route, ultimately sending the user back to the login flow. This is where Im seeing the 429 errors coming

[jaredperreault-okta]

Is your app hosted on the public internet? Being able to witness a reproduction would be helpful here.

I believe a possible solution would be to update your post-logout route to a un-protected route

[sorozco653]

It is not.

We have our base URL to be the login uri to start the login redirect flow, so we would like to keep it as is.

[jaredperreault-okta]

Before the /authorize requests return 429s, are these requests resulting in tokens? Or are they landing the user on the SIW?

Can you paste your OktaAuth config? (please omit sensitive fields)