Electron 'login' event fires repeatedly after wrong credentials — how to stop the 401 retry loop

Repeated auth challenges in Electron

I'm handling HTTP authentication in an Electron app via app.on('login'). My handler calls event.preventDefault() and supplies cached credentials with callback(username, password). When those credentials expire or are rejected by the server, the login event fires again for the same origin, and my handler keeps supplying the same stale credentials — an endless challenge/response loop with no built-in signal from Electron that the credentials were refused.

Constraints

Credentials are stored encrypted via safeStorage.encryptString and decrypted on demand. I want least-privilege behavior: only supply credentials to an allowlisted origin, and fall back to the default Chromium dialog (by not calling preventDefault()) once cached credentials are known to be bad. Assume a recent Electron version (28+) and that the server returns a fresh 401 with WWW-Authenticate on failure.

Questions

• What is the reliable way to detect that the login event firing again means my supplied credentials were rejected, rather than a new independent challenge?
• Is counting repeated challenges per origin within a time window the accepted pattern, or is there a request/response hook (e.g., on webContents or the session) that exposes the final 401 after credentials were submitted?
• Should the retry guard live in the login handler itself, or is it cleaner to invalidate the cached credential after the first failure and let the next challenge show the default dialog?