[Bug]: Getting logged out of PWA on Android

[michaelkuhn]

Bug Summary

When using the PWA on Android, I keep getting logged out since updating to 2.2.11.

Description

Since updating to 2.2.11, when I close the PWA on Android (by swiping it away), I am logged out the next time I start it. I guess this is due to #3502 changing the default policy for cookies. A cursory search shows that other PWAs seem to have the same problem with strict settings:

• https://stackoverflow.com/questions/76526710/request-to-pwa-start-url-does-not-include-cookies
• Always resetting the cookie when a PWA is installed amannn/next-intl#527
• Cookies get deleted after closing installed PWA. pocketbase/pocketbase#2972

It seems to work fine on ChromeOS, though.

Steps to Reproduce

1. Install PWA
2. Log in
3. Close the PWA by swiping it away

Expected Behavior

Users should still be logged in.

Actual Behavior

Users will be logged out.

Version

2.2.11

Browser

Chrome

Relevant Logs or Error Output

Additional Context

No response

Checklist

• I have searched existing issues to ensure this bug hasn't been reported before.

[phrozen77]

Same goes for iOS - logouts appear to be really frequent, basically every other time i refresh the page i'm logged out. And yes, it only happens since the latest update.

iOS 18.6, iPhone 15 Pro, Safari

Edit to add: not using the / a PWA, just browsing the mobile website.

[fguillot]

I can reproduce the issue on Android when Miniflux is installed as PWA.

However, this is working fine on iOS 18.6 with Safari when Miniflux is added to the Home Page, the session remains open even after flushing all cookies and website data.

Honestly, that's seems to be a Android bug, but I'm okay to revert #3502. Any thoughts @jvoisin?

[phrozen77]

However, this is working fine on iOS 18.6 with Safari when Miniflux is added to the Home Page, the session remains open even after flushing all cookies and website data.

Interesting - can you try in "normal" Safari?

FWIW, i use Miniflux behind Nginx Proxy Manager, not sure if that adds to the problem?

[jvoisin]

#3502 shouldn't affect PWA :/

[rickdgeerling]

Observing the same with Brave on Linux. Haven't found the exact trigger mechanism, but I've logged in 6 times in the last 4 days on this machine, and another 10 times on the Android/Chrome PWA.

I've just set OAUTH2_PROVIDER: oidc to see if that affects the outcome. I'll report back tomorrow.

[hollisticated-horse]

Edit to add: not using the / a PWA, just browsing the mobile website.

On mobile, I only get logged out when reopening the PWA after login (both Firefox (Fennec) and Chromium (Cromite and others)).

Am I correct to assume that relevant files to this would be service_worker.js?

[jvoisin]

Am I correct to assume that relevant files to this would be service_worker.js?

Yes, as well as the SameSite flag set on the cookies.

[hollisticated-horse]

#3502 shouldn't affect PWA :/

Seems it does affect PWA:

• Request to PWA start_url does not include cookies

Set SameSite cookie policy to lax

With SameSite=Strict the cookie will not be sent if you are visiting a link from a different web page, which is what happens when you open the PWA for the first time, and that's where SameSite=Lax comes in by allowing the cookie to be sent with these top-level navigations

• Always resetting the cookie when a PWA is installed

Any hit of the app that starts outside of it will not be able to load the cookie for the first time by using strict.

That's why any installed PWA won't get the cookie value loaded and always is reset.

The solution is to change from SameSite='Strict' to SameSite='Lax'.

SameSite=Lax should probably be set if it's the PWA:

if  IsPWAEnabled() { // pseudo function that might need to be made.
    cookie.SameSite = http.SameSiteLaxMode
}

Next up is how to announce if it's the PWA.

[hollisticated-horse]

I've been trying to hack at this for a bit today. One thing I'm struggling to setup is how do I setup miniflux with HTTPS to test on the local network with my phone. Lack of/self-signed certificates seem to stop my phone from installing in standalone mode.

I'm open to ideas.

[jvoisin]

Sigh, it seems that the concept of PWA isn't compatible with `SameSite=Strict: the cookie won't be sent if the user is coming to miniflux from a different origin, which is exactly what happens when the PWA is opened for the first time.

[jvoisin]

Seems like we'll have to revert #135ce1d5. @fguillot do you want to do it, or shall I send a pull-request?

[hollisticated-horse]

Seems like we'll have to revert #135ce1d5. @fguillot do you want to do it, or shall I send a pull-request?

What about detecting when the PWA is installed and only then passing the SameSite=Lax ?