[Bug]: 403 erros when deployment is ongoing

[florian-glombik]

Contact Details

Slack

What happened?

I deployed a branch, now I am spammed with 403 errors

Higher resolution video

heliosSpamsWith403Errors.mov

Steps To Reproduce

1. Deploy a branch (without PR for the branch)
2. See that you are spammed with 403 errors

What browsers are you seeing the problem on?

Chrome

Relevant log output

Request URL https://helios.aet.cit.tum.de/api/deployments/workflowJobStatus/25380338135
Request Method GET
Status Code 403 Forbidden

{
    "status": 403,
    "error": "Forbidden",
    "message": "Error: Access Denied",
    "path": "/api/deployments/workflowJobStatus/25380338135",
    "timestamp": "2026-05-05T14:00:49.613849796Z"
}

[meryemefe]

Hi @florian-glombik , thanks again for reporting this and for sharing the video.

I couldn’t reproduce it with the original written steps at first. After re-checking the video, I was able to identify the trigger and reproduce it:

• User has two Helios tabs open.
• A deployment/write flow is active in tab A.
• User logs out in tab B.
• Tab A does not immediately update auth/permission state, so it can still send requests to write-guarded endpoints, which return 403.

So this is not caused by a newly introduced feature, but by missing cross-tab auth-state synchronization in the client. We were not aware of this gap before your report.

The fix is implemented and currently in review. It will be included in the next deployment.

Thanks again for raising this, it helped us close an important auth consistency issue.

[florian-glombik]

Thank you for the quick fix 🙌

My apologies for the incorrect description for the steps to reproduce, I was not aware that the issue could be caused by another tab in the background 😅
Thanks for figuring that out! 👍