# \*\* CRITICAL BUG \*\* : Anyone has a fix? Else weweb is unusable using token based auth **URL:** \ **Category:** Tips and Hacks\ **Created:** [October 11, 2022, 6:55pm UTC](https://community.weweb.io/t/critical-bug-anyone-has-a-fix-else-weweb-is-unusable-using-token-based-auth/1277 "2022-10-11T18:55:38Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![hsatl](https://avatars.discourse-cdn.com/v4/letter/h/67e7ee/32.png) [@hsatl](https://community.weweb.io/u/hsatl)\ **Post date:** [October 11, 2022, 6:55pm UTC](https://community.weweb.io/t/critical-bug-anyone-has-a-fix-else-weweb-is-unusable-using-token-based-auth/1277/1 "2022-10-11T18:55:38Z")
Hi all, I just found out that if you are using external auth, the Auth Token is erased upon hard refresh. It does not redirect or anything, it is simply erased since the session ended. And the app would generally become unresponsive. Has anyone found a safe way to persist the token? I was assuming it to be functional out of box, but it is not. I am guessing it is not an unreasonable expectation either. Given this behavior, the only option is to use weweb authentication, which is not always preferable. I am guessing there are production apps (I am hoping). How did any of you release the app in production with this critical bug? What fix did you make? ---
**Author:** ![caffeinatedwes](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/caffeinatedwes/32/625_2.png) [@caffeinatedwes](https://community.weweb.io/u/caffeinatedwes)\ **Post date:** [October 11, 2022, 7:30pm UTC](https://community.weweb.io/t/critical-bug-anyone-has-a-fix-else-weweb-is-unusable-using-token-based-auth/1277/2 "2022-10-11T19:30:56Z")
I _think_ you’re mistaken, but I could be wrong. I’ll let others chime in. We use Xano auth and it works just fine, whether you hard refresh, quit the browser, etc. If you hard refresh and the auth token is erased, it sounds like you’re saving and retrieving the auth token somewhere else other than saving it as a cookie. Perhaps this thread will help— [Login with authToken (MagicLink) - #20 by cbpcanda](https://community.weweb.io/t/login-with-authtoken-magiclink/775/20) ---
**Author:** ![hsatl](https://avatars.discourse-cdn.com/v4/letter/h/67e7ee/32.png) [@hsatl](https://community.weweb.io/u/hsatl)\ **Post date:** [October 11, 2022, 7:51pm UTC](https://community.weweb.io/t/critical-bug-anyone-has-a-fix-else-weweb-is-unusable-using-token-based-auth/1277/3 "2022-10-11T19:51:53Z")
I think the problem is there. I had a chat session with support and they think so too. That is why I am looking for a hack quickly. Since the response was somewhat depressing and did not look like there is a built in solution in near future. On a quick read it seems there is a hack via custom javascript using session cookies. This is what I was hoping to find. I will try it later and let you know if it works. ![Screen Shot 2022-10-11 at 3.50.42 PM](https://us1.discourse-cdn.com/flex016/uploads/weweb/original/2X/a/a41f470f4a3eabd5cb5d382cd4398a2c9df1449a.png) ![Screen Shot 2022-10-11 at 3.47.55 PM](https://us1.discourse-cdn.com/flex016/uploads/weweb/original/2X/4/48a740a0cbef36ba5bb01eb06789fdb9c3a9c61a.png) ---
**Author:** ![foliodc](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/foliodc/32/761_2.png) [@foliodc](https://community.weweb.io/u/foliodc)\ **Post date:** [October 11, 2022, 9:59pm UTC](https://community.weweb.io/t/critical-bug-anyone-has-a-fix-else-weweb-is-unusable-using-token-based-auth/1277/4 "2022-10-11T21:59:10Z")
Yeah I hadn’t noticed that before. For me it seems to be a conditional display issue rather than a full logout. When I refresh, sometimes it keeps the same, sometimes it switches to the default. When it switches, sometimes it updates to the correct item when I tap the default, and other times it opens the signup dialogue. You can see the unpredictable behavior in the video below, skip to 30 seconds in sorry: login and the auth icons appear top right refresh once and it’s ok Refresh again and it shows login (non-auth) Tap the login and it corrects to icons Refresh a couple times and it pops in correctly Go to profile page and refresh Non-auth content appears Return to home by address bar and shows non-auth ---
**Author:** ![hsatl](https://avatars.discourse-cdn.com/v4/letter/h/67e7ee/32.png) [@hsatl](https://community.weweb.io/u/hsatl)\ **Post date:** [October 11, 2022, 11:19pm UTC](https://community.weweb.io/t/critical-bug-anyone-has-a-fix-else-weweb-is-unusable-using-token-based-auth/1277/5 "2022-10-11T23:19:44Z")
yeah, very similar but auth is broken. Depending on who is logged in the view changes. Even certain functionality is switched on or off. So auth token disappearing causes havoc. here is the loom I shared with support: here is the video: [Loom | Free Screen & Video Recording Software | Loom](https://www.loom.com/share/8357e2bea3f44ceaae7048e59a247ddd) ---
**Author:** ![hsatl](https://avatars.discourse-cdn.com/v4/letter/h/67e7ee/32.png) [@hsatl](https://community.weweb.io/u/hsatl)\ **Post date:** [October 12, 2022, 10:11am UTC](https://community.weweb.io/t/critical-bug-anyone-has-a-fix-else-weweb-is-unusable-using-token-based-auth/1277/6 "2022-10-12T10:11:41Z")
[@weweb-team](https://community.weweb.io/groups/weweb-team)?? @aurelie? @Quentin? Can you chime in? ---
**Author:** ![Quentin](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/quentin/32/6_2.png) [@Quentin](https://community.weweb.io/u/Quentin)\ **Post date:** [October 12, 2022, 3:52pm UTC](https://community.weweb.io/t/critical-bug-anyone-has-a-fix-else-weweb-is-unusable-using-token-based-auth/1277/7 "2022-10-12T15:52:49Z")
Our CTO is working on the issue as we speak. I don’t have any ETA for now. But I’ll keep you posted. ---
**Author:** ![Quentin](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/quentin/32/6_2.png) [@Quentin](https://community.weweb.io/u/Quentin)\ **Post date:** [October 13, 2022, 10:13am UTC](https://community.weweb.io/t/critical-bug-anyone-has-a-fix-else-weweb-is-unusable-using-token-based-auth/1277/8 "2022-10-13T10:13:14Z")
The fix is in production 😉 ---
**Author:** ![tjmcdonough](https://avatars.discourse-cdn.com/v4/letter/t/258eb7/32.png) [@tjmcdonough](https://community.weweb.io/u/tjmcdonough)\ **Post date:** [October 13, 2022, 11:32am UTC](https://community.weweb.io/t/critical-bug-anyone-has-a-fix-else-weweb-is-unusable-using-token-based-auth/1277/9 "2022-10-13T11:32:33Z")
I was having these issues too. Have you got docs on how often you fire requests to the GET user and Refresh token endpoint? I am getting 2600 requests a minute which seems very over kill. ---
**Author:** ![Quentin](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/quentin/32/6_2.png) [@Quentin](https://community.weweb.io/u/Quentin)\ **Post date:** [October 13, 2022, 12:18pm UTC](https://community.weweb.io/t/critical-bug-anyone-has-a-fix-else-weweb-is-unusable-using-token-based-auth/1277/10 "2022-10-13T12:18:37Z")
I’ll check with the tech team, but that shouldn’t be so much 😨 ---
**Author:** ![hsatl](https://avatars.discourse-cdn.com/v4/letter/h/67e7ee/32.png) [@hsatl](https://community.weweb.io/u/hsatl)\ **Post date:** [October 13, 2022, 12:33pm UTC](https://community.weweb.io/t/critical-bug-anyone-has-a-fix-else-weweb-is-unusable-using-token-based-auth/1277/11 "2022-10-13T12:33:23Z")
Thanks @Quentin and team. I think the fix works, but I think it has created some kind of conflict with some layout components. I am going by correlation here and I have no idea whether the fix caused this new issue or not. The new UI issue is basically in tabbed container. My app has a couple of tabbed containers. So after a hard refresh, the tab headers UI is messed up. It gets completely misaligned. This was not happening before the fix was in. So I am jumping to conclusions here. Any hints or ideas what settings should I be looking for to fix this issue. I made a couple of loom videos for support team, linking them here. video 1: [Loom | Free Screen & Video Recording Software | Loom](https://www.loom.com/share/a2640fc41f494684be07146df4c19476) video 2: [Loom | Free Screen & Video Recording Software | Loom](https://www.loom.com/share/4c10d48d7a554880b38ec29db9e162b4) ---
**Author:** ![Mael](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/mael/32/13246_2.png) [@Mael](https://community.weweb.io/u/Mael)\ **Post date:** [October 14, 2022, 7:45am UTC](https://community.weweb.io/t/critical-bug-anyone-has-a-fix-else-weweb-is-unusable-using-token-based-auth/1277/12 "2022-10-14T07:45:38Z")
The UI issue is also fixed. It was not related 🙂 ---
**Author:** ![George](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/george/32/1661_2.png) [@George](https://community.weweb.io/u/George)\ **Post date:** [November 7, 2022, 12:35pm UTC](https://community.weweb.io/t/critical-bug-anyone-has-a-fix-else-weweb-is-unusable-using-token-based-auth/1277/13 "2022-11-07T12:35:49Z")
For me the same issue still be actual. When a token is lost, the application’s actions are unpredictable. No redirect to login page. It is extremely bad that the user is left with a blank page with no content, because the content is issued in exchange for a token. Also, the token is lost within just a few hours. The token can be lost simply while using the application and then the video playback freezes for example. We need a hotfix! We just moved from Adalo and my users are burning our support team with the same question. ---
**Author:** ![stefank](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/stefank/32/4202_2.png) [@stefank](https://community.weweb.io/u/stefank)\ **Post date:** [April 24, 2024, 1:36pm UTC](https://community.weweb.io/t/critical-bug-anyone-has-a-fix-else-weweb-is-unusable-using-token-based-auth/1277/14 "2024-04-24T13:36:30Z")
Hi, is this still a problem? I built an app and stumbled upon the same behaviour. User is logged in, everything works fine. User refreshes the pages and is logged out. It reloads the page, but the page is broken since many elements are bound to the user status. Another refresh leads to a redirect to the login page. How can I fix this? This is extremely annoying for the users.