# Dashboard 2.0 PWA: Service Worker prevents authentication redirect when session expires

**URL:** https://discourse.nodered.org/t/dashboard-2-0-pwa-service-worker-prevents-authentication-redirect-when-session-expires/100574
**Category:** Dashboard
**Tags:** dashboard-2
**Created:** [16 March 2026 07:14 UTC](https://discourse.nodered.org/t/dashboard-2-0-pwa-service-worker-prevents-authentication-redirect-when-session-expires/100574 "2026-03-16T07:14:09Z")
**Posts on this page:** 8
**Page:** 2

<div class="post-metadata">

### Author: ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)
#### Post date: [18 March 2026 10:31 UTC](https://discourse.nodered.org/t/dashboard-2-0-pwa-service-worker-prevents-authentication-redirect-when-session-expires/100574/21 "2026-03-18T10:31:32Z")

</div>

Is it ok using local LAN names such as pi04.local?

---

<div class="post-metadata">

### Author: ![bakman2](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bakman2/32/6207_2.png) [@bakman2](https://discourse.nodered.org/u/bakman2)
#### Post date: [18 March 2026 12:12 UTC](https://discourse.nodered.org/t/dashboard-2-0-pwa-service-worker-prevents-authentication-redirect-when-session-expires/100574/22 "2026-03-18T12:12:41Z")

</div>

yes that works indeed.

---

<div class="post-metadata">

### Author: ![pakerfeldt](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/pakerfeldt/32/3101_2.png) [@pakerfeldt](https://discourse.nodered.org/u/pakerfeldt)
#### Post date: [18 March 2026 13:40 UTC](https://discourse.nodered.org/t/dashboard-2-0-pwa-service-worker-prevents-authentication-redirect-when-session-expires/100574/23 "2026-03-18T13:40:00Z")

</div>

Thanks for sharing, but it's unrelated to my issue. I already connect using DNS name.

---

<div class="post-metadata">

### Author: ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [18 March 2026 13:58 UTC](https://discourse.nodered.org/t/dashboard-2-0-pwa-service-worker-prevents-authentication-redirect-when-session-expires/100574/24 "2026-03-18T13:58:55Z")

</div>

> [@bakman2](#):
>
> it will [no longer allow websocket connections over ip addresses](https://www.reddit.com/r/webdev/comments/1pzmhvf/websocket_broken_on_safariios_26/) - it requires a DNS name. If the dashboard connects over local ip, it won't work

Interesting. I've just been testing some new front-end code for uibuilder on Mac (latest) and web sockets do seem to be working. However, I am using a secured link (HTTPS/WSS) which was alluded to in the shared thread.

Why anyone uses Safari is beyond me, it is the IE of the 2020's. It ignores new standards, sometimes forever, sometimes for years. All-round, a pain.

Thankfully, you _can_, these days, use sensible browsers like Vivaldi or not so sensible ones like Firefox on iOS and Mac. 😃

BTW, the new additions to the uibuilder client library are cross-browser stack-traces. Work great on Chromium and Firefox browsers but virtually useless on Safari as it does not provide much in the way of useful info. Sadly, while stack trace standards are currently making their way into the JavaScript standards, the output formats are still being left up to the browser which is a pain because the different engines use different formats.

---

<div class="post-metadata">

### Author: ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)
#### Post date: [24 March 2026 22:07 UTC](https://discourse.nodered.org/t/dashboard-2-0-pwa-service-worker-prevents-authentication-redirect-when-session-expires/100574/25 "2026-03-24T22:07:20Z")

</div>

You said in the first post that it hangs on startup .with the disconnected image'. Do you mean the 'Connection Lost Attempting to reconnect to server' popup? If so, with the original s/w, if you leave it 5 minutes (or a little more) does it recover?

---

<div class="post-metadata">

### Author: ![mayerwin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mayerwin/32/106767_2.png) [@mayerwin](https://discourse.nodered.org/u/mayerwin)
#### Post date: [20 April 2026 01:12 UTC](https://discourse.nodered.org/t/dashboard-2-0-pwa-service-worker-prevents-authentication-redirect-when-session-expires/100574/26 "2026-04-20T01:12:55Z")

</div>

Landed here because I hit the identical problem on a completely different PWA: Home Assistant behind Cloudflare Tunnel + Access. Same three-way trap: Service Worker replays the cached shell before the network is consulted, CORS strips the 302 redirect from background fetches, WebSockets abort on HTML instead of a 101 handshake. Nice writeup of the root cause. Nobody else seems to have pinned it down this precisely.

For anyone who needs a runtime-only fix while waiting for an upstream release (Node-RED, HA, or otherwise), I published a drop-in JS module that polls with a cache-buster + `redirect: 'manual'` to detect the Cloudflare wall, unregisters the SW, and reloads: [GitHub - mayerwin/HA-Cloudflare-Access-Recovery: Self-healing Cloudflare Access auth for Home Assistant - recovers the HA web frontend in any browser (desktop or mobile) when the CF\_Authorization cookie expires. · GitHub](https://github.com/mayerwin/HA-Cloudflare-Access-Recovery)

It's shaped for HA but the detection logic is generic to any PWA behind Cloudflare Access. Happy to see `pakerfeldt`'s PR moving. Removing the SW from the nav path is the cleaner fix if you control the app.

---

<div class="post-metadata">

### Author: ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)
#### Post date: [20 April 2026 08:26 UTC](https://discourse.nodered.org/t/dashboard-2-0-pwa-service-worker-prevents-authentication-redirect-when-session-expires/100574/27 "2026-04-20T08:26:09Z")

</div>

Are you seeing this issue on Android (the cache issue I mean, not the CORS issue)?

[Edit] By the CORS issue I meant [Hang with Connection Lost message when using authentication proxy and session times out whilst page is inactive · Issue #2074 · FlowFuse/node-red-dashboard · GitHub](https://github.com/FlowFuse/node-red-dashboard/issues/2074) which has a PR waiting for review.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)
#### Post date: [20 May 2026 08:27 UTC](https://discourse.nodered.org/t/dashboard-2-0-pwa-service-worker-prevents-authentication-redirect-when-session-expires/100574/28 "2026-05-20T08:27:04Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

[Previous page](https://discourse.nodered.org/t/dashboard-2-0-pwa-service-worker-prevents-authentication-redirect-when-session-expires/100574.md?page=1)
