Can't sign in when service worker is active

[lucacasonato]

• code-server version: 22b485a
• OS Version: macOS 10.14.4

Description

When trying to sign in with the service-worker enabled you just get the error "Password is incorrect!".

Cause

When using the service worker we are caching the index.html file (or equivalent). When entering the password, the page gets reloaded, but the cached version is pulled from the service-worker.

Steps to Reproduce

1. Run code-server with valid, signed TLS certs and use https.
2. Open code-server.
3. Enter the password.
4. Submit the password.
5. Failure

Fix

Stop caching the index.html file.

[lucacasonato]

We should also consider adding no cache headers to all html we send.

[code-asher]

Merged your PR, but I'm making some changes to make all the CSS, JavaScript, and HTML names unique so there won't be any conflicts between the login page and the IDE. That would make it possible to cache the HTML again right?

Edit: actually I guess the HTML has to be named index.html. Disregard!

Edit 2: I'm now thinking we should serve the login page under /login instead. (Still need the HTML exclusion though, it doesn't change that (I think), just seems like it might be safer.)

[lucacasonato]

I am not sure putting login on a different endpoint this would solve the issue though as the redirect from / to /login would still be cached. Not 100% on this tho. I don't think it is worth the effort, especially because the html files are only a few kilobytes small and thus are very fast to load. code-server doesn't work offline anyway so I think it doesn't really matter.

[code-asher]

Yup, that's exactly what I found to be the case when I moved it (I still feel like it makes sense to have it on a different path though).

Do you know if there's an option to not to cache the redirect? Everything works great except when I delete the cookie I have to refresh twice, and then when I log in I have to do that twice as well. 😕

[code-asher]

I should mention I'm seeing that double login behavior with the new changes that exclude HTML files from being cached. Very confused.

Edit: maybe it's the request for / itself being cached.

[code-asher]

Ended up excluding everything in the precache then explicitly adding assets to the runtime cache: https://github.com/codercom/code-server/pull/518/files#diff-099338867131948cef1de5780d9fc643R74

It seems to solve the double refresh issue. I probably could have just excluded / and /login though. I'm not sure whether the runtime cache is good enough or whether we should still have the precache. I like the idea of explicitly deciding which assets to cache, so we could use include for that and remove the exclude line.

If you get a chance to see it, let me know whether you think it's reasonable or not. Thanks!