We have two different OAuth2/OKTA-enabled JHipster monolith applications, one uses JHipster version 6.10.5, and the other version 7.9.2. These webapps use the OKTA sign-in widget and are represented as different applications in OKTA, each with its own client-id/secret. Each webapp works completely as expected on its own.
But when opening these webapps in different browser tabs and flipping between them, which is a requirement, each time I switch from one tab to the other and do something that requires an API request, I get a 401-unauthorised response, which causes the AuthExpiredInterceptor to trigger a re-login. This happens when flipping between tabs in both directions. Most times it redirects right back to the application without requiring me to actually enter a username/password, but the problem is that any data entered into the browser is lost.
On my local dev machine, the apps are running on different ports (8080 and 8090), but this cross-interference effect is also seen when running on a server. As these are totally separate monolith applications, it is puzzling why they should interact in this way. I suspect it has to do with some aspect of spring security that I am not understanding.
I tried checking the OKTA settings for the two apps in case there was something that could explain this interaction between them, but could not find anything obvious, which is what I expected as these are represented as totally separate web applications in OKTA. I considered trying to troubleshoot the spring security config (security filter chain), but I am no spring security expert, so I was hoping for some help/direction before doing so.
Any help and insights are greatly appreciated.
localhost
. My gut tells me the port should make them unique, but it might not. If you deploy them to separate domains (e.g. on Heroku), do you still have issues?