Changeset bf72108 in Klonkt for CHANGELOG.md

Timestamp:

07/19/2026 04:04:25 AM (7 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

4407c67

Parents:

dd568e7

git-author:

Robin <roboburr@…> (07/19/2026 04:04:05 AM)

git-committer:

Robin <roboburr@…> (07/19/2026 04:04:25 AM)

Message:

Fix: OAuth consent hands off to native apps via an interstitial

After Allow/Deny the server 302-redirected to the client's redirect_uri. For a
native custom scheme (com.klonkt.shaer:/oauth) that 302 is silently dropped by
mobile browsers (no user gesture to launch an external app), so Allow/Deny
appeared to do nothing. finishRedirect() now keeps the 302 for http/https
clients but, for a non-http redirect_uri, serves a tiny interstitial that
meta/JS auto-forwards AND shows an 'Open the app' tap link — a tap is the user
gesture Android needs, and iOS's ASWebAuthenticationSession intercepts either
navigation. Used for both allow (code) and deny/error. Verified: native →
interstitial HTML with the code + tap link; https → still 302; deny → error in
the interstitial. 80 tests green.

Co-Authored-By: Claude Opus 4.8 <noreply@…>

File:

• CHANGELOG.md (modified) (1 diff)

CHANGELOG.md

@@ -26 +26 @@
 
 ### Fixed
+- **OAuth consent now hands off reliably to native apps.** After Allow/Deny, a
+  redirect to a native custom scheme (e.g. `com.klonkt.shaer:/oauth`) was a plain
+  302, which mobile browsers silently drop. The consent step now serves a tiny
+  interstitial for non-http redirect URIs that auto-forwards and offers an "Open
+  the app" tap link (a tap reliably launches the app on Android; iOS's web-auth
+  session intercepts either way). Web (http/https) clients still get a 302.
 - **Visitors can reply to the site owner's own comments.** The "reply via the
   fediverse" button only appeared on comments from others; the site's own