Fix failure of calling authenticated APIs from secondary AsgardeoProvider Instances (Multi-Provider Support) by kavindadimuthu · Pull Request #337 · asgardeo/javascript

kavindadimuthu · 2026-01-26T04:37:44Z

Purpose

This pull request introduces multi-HTTP clients support when multiple provider instances are implemented. This ensures that all authenticated HTTP operations are isolated per instance.

The most important changes are:

Instance-specific HTTP Client Management

Refactored HttpClient to support multiple isolated HTTP client/axios instances, each keyed by instance ID, preventing state conflicts between auth contexts. All HTTP handler flags and callbacks are now instance-specific. [1] [2] [3] [4] [5] [6] [7] [8]
Updated all usages of HttpClient.getInstance() to provide the correct instance ID, ensuring HTTP requests are routed through the correct context. [1] [2] [3] [4]

Related Issues

Fixes bug: Authenticated API Calls Fail for Secondary AsgardeoProvider Instances (Multi-Provider Support) #335

Related PRs

Checklist

Followed the CONTRIBUTING guidelines.
Manual test round performed and verified.
Documentation provided. (Add links if there are any)
Unit tests provided. (Add links if there are any)

Security checks

Followed secure coding standards in http://wso2.com/technical-reports/wso2-secure-engineering-guidelines?
Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets?

packages/browser/src/__legacy__/http-client/clients/axios-http-client.ts

DonOmalVindula

The multiton refactoring looks good overall and the approach is correct. However, there's a this-binding bug that needs to be fixed before merging — see inline comments.

packages/browser/src/__legacy__/http-client/clients/axios-http-client.ts

DonOmalVindula

A few more issues I noticed during review.

DonOmalVindula · 2026-02-20T08:55:09Z

packages/browser/src/__legacy__/clients/main-thread-client.ts


  let _getSignOutURLFromSessionStorage: boolean = false;

-  const _httpClient: HttpClientInstance = HttpClient.getInstance();


Bug: worker-core.ts has the same pattern at the same line — HttpClient.getInstance() without an instanceId — but was missed in this PR. The web worker path will always fall back to instanceId=0 regardless of which provider spawned it.

Suggestion: Thread the instanceID through to WebWorkerCore the same way it's done in MainThreadClient:

export const WebWorkerCore = async ( instanceID: number, config: AuthClientConfig<WebWorkerClientConfig>, ... ): Promise<WebWorkerCoreInterface> => { ... const _httpClient: HttpClientInstance = HttpClient.getInstance(instanceID); ... };

See packages/browser/src/__legacy__/worker/worker-core.ts:65.

Resolved this

DonOmalVindula · 2026-02-20T08:55:09Z

packages/browser/src/__legacy__/http-client/clients/axios-http-client.ts

-  private static isHandlerEnabled: boolean;
+  private static instances: Map<number, HttpClientInstance> = new Map();
+  private static clientInstances: Map<number, HttpClient> = new Map();
+  private isHandlerEnabled: boolean = true;


Memory leak: Instances are added to these static Maps but never removed. If an AsgardeoProvider unmounts and remounts (e.g. React hot-reload, dynamic multi-tenant switching), stale axios instances with outdated interceptors and callbacks will accumulate.

Suggestion: Add a static cleanup method:

public static destroyInstance(instanceId: number): void { const axiosInstance = this.instances.get(instanceId); if (axiosInstance) { // Eject interceptors to prevent memory leaks axiosInstance.interceptors.request.clear(); axiosInstance.interceptors.response.clear(); } this.instances.delete(instanceId); this.clientInstances.delete(instanceId); }

This should be called during provider teardown.

Resolved this

DonOmalVindula · 2026-02-20T08:55:09Z

packages/browser/src/__legacy__/http-client/clients/axios-http-client.ts

-  private static clientInstance: HttpClient;
-  private static isHandlerEnabled: boolean;
+  private static instances: Map<number, HttpClientInstance> = new Map();
+  private static clientInstances: Map<number, HttpClient> = new Map();


Dead code: clientInstances is write-only — nothing ever calls clientInstances.get(). If you add a destroyInstance() method (see my other comment), this map becomes useful for cleanup. Otherwise, it should be removed to avoid confusion.

Resolved this

…auth context

…ct 'this' context in HttpClient

…e to support instance ID - Implement `destroyInstance` method in `HttpClient` to clean up instances and prevent memory leaks. - Update `WebWorkerCore` to accept an `instanceID` parameter for better instance management. - Modified `workerReceiver` to handle instance ID during initialization and pass it to `WebWorkerCore`.

asgardeo-github-bot · 2026-02-24T05:39:24Z

🦋 Changeset detected

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

DonOmalVindula

The core singleton → multiton refactoring looks correct and all previous review comments have been addressed. A few remaining items to clean up before merging.

DonOmalVindula · 2026-02-24T06:16:52Z

packages/browser/src/__legacy__/http-client/clients/axios-http-client.ts

+    if (axiosInstance) {
+      // Eject interceptors to prevent memory leaks
+      axiosInstance.interceptors.request.clear();
+      axiosInstance.interceptors.response.clear();


destroyInstance() is defined but never called anywhere. It needs to be wired into the provider teardown/unmount lifecycle (e.g., in AsgardeoProvider's cleanup) to actually prevent the memory leak it was designed to address. Without a caller, this is dead code.

Please either:

Wire it into the provider's useEffect cleanup, or

Remove it and track the cleanup as a separate follow-up issue.

DonOmalVindula · 2026-02-24T06:16:52Z

packages/browser/src/__legacy__/clients/web-worker-client.ts


-    const message: Message<AuthClientConfig<WebWorkerClientConfig>> = {
-      data: config,
+    const message: Message<AuthClientConfig<WebWorkerClientConfig> & {instanceID: number}> = {


Mixing instanceID into the config data payload via intersection type (& {instanceID: number}) is fragile. If AuthClientConfig ever adds an instanceID field, it will silently conflict.

Nit: Consider passing instanceID as a separate field on the Message type rather than stuffing it into data.

DonOmalVindula · 2026-02-24T06:16:53Z

packages/browser/src/__legacy__/http-client/clients/axios-http-client.ts

-      return this.axiosInstance;
+  public static getInstance(instanceId: number = 0): HttpClientInstance {
+    if (this.instances.has(instanceId)) {
+      return this.instances.get(instanceId)!;


Nit: Naming inconsistency — this method uses instanceId (camelCase) while MainThreadClient, WebWorkerCore, and workerReceiver all use instanceID (all-caps ID). Pick one convention and use it consistently across the codebase.

DonOmalVindula · 2026-02-24T06:18:16Z

You can address the added comments in a follow-up PR

kavindadimuthu force-pushed the fix/multi-http-clients branch from d3e913b to 0744686 Compare February 3, 2026 05:57

DonOmalVindula reviewed Feb 3, 2026

View reviewed changes

packages/browser/src/__legacy__/http-client/clients/axios-http-client.ts Show resolved Hide resolved

kavindadimuthu force-pushed the fix/multi-http-clients branch 3 times, most recently from a6c1841 to 12fd275 Compare February 18, 2026 17:13

DonOmalVindula requested changes Feb 19, 2026

View reviewed changes

packages/browser/src/__legacy__/http-client/clients/axios-http-client.ts Show resolved Hide resolved

packages/browser/src/__legacy__/http-client/clients/axios-http-client.ts Outdated Show resolved Hide resolved

DonOmalVindula reviewed Feb 20, 2026

View reviewed changes

kavindadimuthu added 5 commits February 24, 2026 10:57

Refactor HttpClient to support instance-specific instances for multi-…

d543202

…auth context

Refactor HttpClient to initialize isHandlerEnabled value as undefined

7923936

Initialize isHandlerEnabled to true and bind handler methods to corre…

cc208b6

…ct 'this' context in HttpClient

Add changeset 🦋

303663e

kavindadimuthu force-pushed the fix/multi-http-clients branch from 758ffe6 to 74bdd93 Compare February 24, 2026 05:28

Refactor web-worker files to change endoflines to lf

8571623

DonOmalVindula requested changes Feb 24, 2026

View reviewed changes

DonOmalVindula approved these changes Feb 24, 2026

View reviewed changes

DonOmalVindula merged commit 3b6c874 into asgardeo:main Feb 24, 2026
7 of 8 checks passed

asgardeo-github-bot mentioned this pull request Feb 24, 2026

[Release] [GitHub Action] Update package versions #378

Open


		let _getSignOutURLFromSessionStorage: boolean = false;

		const _httpClient: HttpClientInstance = HttpClient.getInstance();

Comments

Conversation

kavindadimuthu commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Purpose

Related Issues

Related PRs

Checklist

Security checks

Uh oh!

Uh oh!

DonOmalVindula left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

DonOmalVindula left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

asgardeo-github-bot commented Feb 24, 2026

🦋 Changeset detected

Uh oh!

DonOmalVindula left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DonOmalVindula commented Feb 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

kavindadimuthu commented Jan 26, 2026 •

edited

Loading