How multiple open browser tabs can accidentally DDOS your auth server, and how to fix it with the Web Locks API.
Picture this: You’ve just shipped a state-of-the-art Axios response interceptor. You implemented a mutex lock (isRefreshing) and a promise queue (failedQueue) to handle concurrent 401 errors. You tested it within a single tab, and it worked like a charm. You gave yourself a high-five and closed your laptop.
Then, a power user logs in.
Like most humans on the internet, they don't use just one browser tab. They open Tab 1 for User Management, Tab 2 for Analytics, Tab 3 for Settings, and Tab 4 for Support Tickets.
Fifteen minutes pass. Their short-lived JWT access token expires.
