maxUserConcurrentAccesses counts closed sessions, so a new join ejects the live device

Open
  • Is something wrong?
#26,477 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
56/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
typescript
Domain
audio-video-rtc, backend

Research direction

Start by reading RegisterUserReqMsgHdlr.checkUserConcurrentAccesses and trace how joined, loggedOut, and ejected are updated, especially in MeetingActor.removeUsersWithExpiredUserLeftFlag and UserLeaveReqMsgHdlr. Reproduce the described sequence with maxUserConcurrentAccesses=3 and verify that closed sessions no longer cause the live device to be ejected while explicit leaves still work.

Written by the indexing model from the issue text.

Description

module: core
Describe the bug

Sessions that end without the user clicking "Leave" (a closed tab or browser, a phone that died, a network drop) keep counting toward maxUserConcurrentAccesses. A user who is live on one device and has opened and closed the meeting on others can therefore have their live device ejected by the next join, although they are under the limit.

To Reproduce

With maxUserConcurrentAccesses=3 (the default):

  1. Device A joins with a user's join URL (fixed userID), joins audio and shares a webcam.
  2. Device B joins with the same join URL, then its tab is closed (no "Leave"). Wait until the server has dropped it from the meeting (about 15 s).
  3. Device C does the same.
  4. Device D joins with the same join URL.
Expected behavior

Only A and D are in the meeting, under the limit of 3: nobody is ejected, and A keeps its audio and webcam.

Actual behavior

D's join ejects A, the only live device. akka-apps logs:

User w_xbzcktlxdbgh with extId=student-1 has 3 concurrent accesses and limit is 3. Ejecting the oldest=w_7lfuwiye6gjp in meetingId=...

w_7lfuwiye6gjp is device A. A's tab shows "You have been removed from the session" without saying why, and the other users no longer see A's webcam. Reproduced 2 of 2 on 4.0.2 (automated with Playwright; the tabs were closed with the page's unload handlers running, as a browser closes them).

The user table just before D joined: B and C are out of the meeting, but neither loggedOut nor ejected, so they still count.

Device Internal id In the meeting loggedOut ejected
A (live) w_7lfuwiye6gjp true false false
B (tab closed) w_heskybykwslh false false false
C (tab closed) w_uhmhsj6f0qal false false false

Control: when B and C click "Leave meeting" instead, they are marked loggedOut, D joins and A stays (1 of 1).

Screenshots

An observer (moderator), device A and device D side by side; devices B and C are not shown. The observer's strip shows the user's sessions from the user table.

01-closed-sessions-eject-the-live-device.mp4:

https://github.com/user-attachments/assets/e2bd843a-4290-4a0e-b275-ee53223db207

Environment
Server
$ sudo bbb-conf --check | grep BigBlueButton
BigBlueButton Server 4.0.2 (0)

bbb-apps-akka 2:4.0.2+20261106T150908 (v4.0.x-develop at 7e07c4a82b), bbb-web 2:4.0.2+20261106T151557 (v4.0.x-develop at a292490e19). First seen on 4.0.0-rc.5.

Desktop
  • OS: Ubuntu 24.04 (headless test clients)
  • Browser: Chromium (Playwright 1.56.0)
  • Version: 141.0.7390.37
Smartphone
  • Not tested.
Additional context
  • Cause: RegisterUserReqMsgHdlr.checkUserConcurrentAccesses counts every registration with the same external id that is neither loggedOut nor ejected, and ejects the oldest. loggedOut is set only by an explicit leave (UserLeaveReqMsgHdlr) or a guest leaving the lobby (UsersApp.guestWaitingLeft). A session closed or lost any other way is removed from the meeting (MeetingActor.removeUsersWithExpiredUserLeftFlag, which sets joined = false) but stays counted.
  • Possible fix: count only registrations whose user is still in the meeting (joined, or present in Users2x), or mark the registration logged out when its user is removed for good.
  • A reconnect of an existing tab cannot trigger this: the check runs only when bbb-web registers a new join (the join URL opened again). Reconnecting tabs reuse their registration.
  • Where users reopen meeting links often (an LMS button, a phone app, reloading from the invitation), the slots fill with dead sessions, and the user's live session is the one ejected.
Dominant language
TypeScript
Stars
9.3k
Forks
6k
Avg merge
2d 7h
Merged PRs (30d)
282

Getting set up

  • No Dockerfile or Docker Compose file
  • Has a pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from bigbluebutton/bigbluebutton

All issues in bigbluebutton/bigbluebutton

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.