Changeset bf72108 in Klonkt

Timestamp:

07/19/2026 04:04:25 AM (7 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

4407c67

Parents:

dd568e7

git-author:

Robin <roboburr@…> (07/19/2026 04:04:05 AM)

git-committer:

Robin <roboburr@…> (07/19/2026 04:04:25 AM)

Message:

Fix: OAuth consent hands off to native apps via an interstitial

After Allow/Deny the server 302-redirected to the client's redirect_uri. For a
native custom scheme (com.klonkt.shaer:/oauth) that 302 is silently dropped by
mobile browsers (no user gesture to launch an external app), so Allow/Deny
appeared to do nothing. finishRedirect() now keeps the 302 for http/https
clients but, for a non-http redirect_uri, serves a tiny interstitial that
meta/JS auto-forwards AND shows an 'Open the app' tap link — a tap is the user
gesture Android needs, and iOS's ASWebAuthenticationSession intercepts either
navigation. Used for both allow (code) and deny/error. Verified: native →
interstitial HTML with the code + tap link; https → still 302; deny → error in
the interstitial. 80 tests green.

Co-Authored-By: Claude Opus 4.8 <noreply@…>

Files:

• CHANGELOG.de.md (modified) (1 diff)
• CHANGELOG.md (modified) (1 diff)
• CHANGELOG.nl.md (modified) (1 diff)
• src/routes/oauth.js (modified) (2 diffs)

CHANGELOG.de.md

@@ -28 +28 @@
 
 ### Behoben
+- **OAuth-Zustimmung übergibt jetzt zuverlässig an native Apps.** Nach
+  Allow/Deny war die Weiterleitung an ein natives Custom-Scheme (z. B.
+  `com.klonkt.shaer:/oauth`) ein einfacher 302, den mobile Browser stillschweigend
+  verwerfen. Der Zustimmungsschritt liefert nun eine kleine Zwischenseite für
+  Nicht-http-Redirect-URIs, die automatisch weiterleitet und einen "App öffnen"-
+  Tipp-Link bietet (ein Tipp startet die App auf Android zuverlässig; iOS'
+  Web-Auth-Session fängt sie ohnehin ab). Web-Clients (http/https) bekommen
+  weiterhin einen 302.
 - **Besucher können auf die eigenen Kommentare des Seiteninhabers antworten.**
   Der Knopf "über das Fediverse antworten" erschien nur bei Kommentaren anderer;

CHANGELOG.md

@@ -26 +26 @@
 
 ### Fixed
+- **OAuth consent now hands off reliably to native apps.** After Allow/Deny, a
+  redirect to a native custom scheme (e.g. `com.klonkt.shaer:/oauth`) was a plain
+  302, which mobile browsers silently drop. The consent step now serves a tiny
+  interstitial for non-http redirect URIs that auto-forwards and offers an "Open
+  the app" tap link (a tap reliably launches the app on Android; iOS's web-auth
+  session intercepts either way). Web (http/https) clients still get a 302.
 - **Visitors can reply to the site owner's own comments.** The "reply via the
   fediverse" button only appeared on comments from others; the site's own

CHANGELOG.nl.md

@@ -27 +27 @@
 
 ### Opgelost
+- **OAuth-toestemming geeft nu betrouwbaar over aan native apps.** Na Allow/Deny
+  was de redirect naar een native custom-scheme (bijv. `com.klonkt.shaer:/oauth`)
+  een gewone 302, en die negeren mobiele browsers stilzwijgend. De toestemmings-
+  stap serveert nu een klein tussenscherm voor niet-http redirect-URI's dat
+  automatisch doorstuurt én een "Open de app"-tikknop biedt (een tik opent de app
+  betrouwbaar op Android; iOS' web-auth-sessie vangt 'm sowieso op). Web-clients
+  (http/https) krijgen nog steeds een 302.
 - **Bezoekers kunnen reageren op de eigen reacties van de site-eigenaar.** De
   knop "reageer via de fediverse" verscheen alleen bij reacties van anderen; bij

src/routes/oauth.js

@@ -45 +45 @@
 }
 
+// Hand control back to the client at redirect_uri + params. For a web client
+// (http/https) a plain 302 is right. For a NATIVE custom scheme
+// (com.klonkt.shaer:/oauth) a 302 is unreliable: mobile browsers routinely drop
+// a server redirect to a custom scheme (no user gesture). So we serve a tiny
+// interstitial that both auto-forwards AND offers a tap link — a tap is a user
+// gesture that launches the app on Android, and iOS's ASWebAuthenticationSession
+// intercepts either navigation. Same page for allow and deny (neutral copy).
+function finishRedirect(res, redirectUri, params) {
+  const target = redirectWith(redirectUri, params);
+  if (/^https?:\/\//i.test(redirectUri)) return res.redirect(target);
+  const attr = target.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;');
+  return res.type('html').send(`<!doctype html>
+<html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<meta http-equiv="refresh" content="0;url=${attr}">
+<title>Return to the app</title>
+<style>body{font-family:system-ui,-apple-system,sans-serif;background:#111;color:#eee;margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;text-align:center}
+.box{padding:1.5rem}p{color:#aaa;line-height:1.5}a.btn{display:inline-block;margin-top:1.2rem;padding:.85rem 1.7rem;border-radius:12px;background:#5A32E6;color:#fff;text-decoration:none;font-weight:700}</style>
+</head><body><div class="box">
+<p>Almost done. If the app doesn't open by itself:</p>
+<a class="btn" href="${attr}">Open the app</a>
+</div>
+<script>location.replace(${JSON.stringify(target)});</script>
+</body></html>`);
+}
+
 // Bounce back to the client with an OAuth error (RFC 6749 §4.1.2.1) when we have
 // a validated redirect_uri; otherwise render a plain error (open-redirect guard).
 function authError(res, redirectUri, state, error, desc) {
-  if (redirectUri) return res.redirect(redirectWith(redirectUri, { error, error_description: desc, state }));
+  if (redirectUri) return finishRedirect(res, redirectUri, { error, error_description: desc, state });
   return res.status(400).json({ error, error_description: desc });
 }
@@ -111 +137 @@
   });
   if (out.error) return authError(res, redirect_uri, state, out.error, out.error_description);
-  return res.redirect(redirectWith(redirect_uri, { code: out.code, state }));
+  return finishRedirect(res, redirect_uri, { code: out.code, state });
 });