@thunderid/browser 1.14.0 → 1.15.0

package/dist/cjs/index.cjs

@@ -695,6 +695,12 @@ var SPAUtils_default = SPAUtils;
 
 //#endregion
 //#region src/utils/AuthenticationHelper.ts
+/** Methods that change nothing on the server, so sending one twice is harmless. */
+const RETRY_SAFE_HTTP_METHODS = [
+	"GET",
+	"HEAD",
+	"OPTIONS"
+];
 /**
 * Browser-level authentication helper that orchestrates HTTP requests with token attachment,
 * automatic token refresh, and the silent sign-in flow.
@@ -810,6 +816,21 @@ var AuthenticationHelper = class {
 			return Promise.reject(error);
 		}
 	}
+	/**
+	* Whether a failed request should be sent again after a token refresh: any method on a 401, and
+	* only a safe method when there is no response, since the server may have acted on it. A request the
+	* caller aborted is never sent again.
+	*
+	* @param error - The error the request failed with.
+	* @param requestConfig - The failed request's configuration.
+	* @returns `true` if the request should be sent again after a token refresh.
+	*/
+	shouldRetryAfterRefresh(error, requestConfig) {
+		if (error?.code === "ABORT_ERROR" || error?.name === "AbortError") return false;
+		if (error?.response?.status === 401) return true;
+		if (error?.response) return false;
+		return RETRY_SAFE_HTTP_METHODS.includes((requestConfig?.method ?? "GET").toUpperCase());
+	}
 	async retryFailedRequests(failedRequest) {
 		const { httpClient, requestConfig, isHttpHandlerEnabled, httpErrorCallback, httpFinishCallback } = failedRequest;
 		await SPAUtils_default.until(() => !this._isTokenRefreshing);
@@ -825,7 +846,7 @@ var AuthenticationHelper = class {
 	}
 	/**
 	* Sends an HTTP request via the provided client, automatically attaching the token,
-	* and retries once after a token refresh on a 401 response.
+	* and retries once after a token refresh when `shouldRetryAfterRefresh` allows it.
 	*
 	* @param httpClient - The HTTP client to use.
 	* @param requestConfig - The request configuration.
@@ -839,7 +860,7 @@ var AuthenticationHelper = class {
 		return httpClient.request(requestConfig).then((response) => {
 			return Promise.resolve(response);
 		}).catch(async (error) => {
-			if (error?.response?.status === 401 || !error?.response) {
+			if (this.shouldRetryAfterRefresh(error, requestConfig)) {
 				if (this._isTokenRefreshing) return this.retryFailedRequests({
 					enableRetrievingSignOutURLFromSession,
 					httpClient,