OAuth: pending auth lost on process death #15

New issue

Closed

opened 2026-06-18 00:02:09 +00:00 by starsetbyte · 1 comment

starsetbyte commented

2026-06-18 00:02:09 +00:00

Owner

Problem

Pending authorization is memory-only. Android can kill app while in browser. On return, no pending auth.

Proposed fix

Persist state, code verifier, DID, PDS URL, metadata, DPoP key before opening browser. Private key behind Android Keystore.

Source: Codex code review — auth #1

## Problem Pending authorization is memory-only. Android can kill app while in browser. On return, no pending auth. ## Proposed fix Persist state, code verifier, DID, PDS URL, metadata, DPoP key before opening browser. Private key behind Android Keystore. Source: Codex code review — auth #1

starsetbyte added the

bug

auth

reliability

labels

2026-06-18 00:02:09 +00:00

starsetbyte referenced this issue from a commit

2026-06-21 12:47:52 +00:00

fix(auth): persist pending OAuth across process death — closes #15

starsetbyte referenced this issue from a pull request that will close it,

2026-06-21 12:48:18 +00:00

fix(auth): persist pending OAuth across process death (closes #15) #32

starsetbyte commented

2026-06-21 12:48:31 +00:00

Author

Owner

Fix up in PR #32 (fix/oauth-pending-auth-process-death).

Root cause confirmed: the pending authorization (DPoP key, PKCE verifier, CSRF state, discovery) lived only in memory — on the AtProtoOAuthClient singleton and duplicated as pendingState in OAuthLoginViewModel. Process death during the browser step wiped both, so completeLogin threw No pending auth.

New PendingAuthStore persists it to EncryptedSharedPreferences before the browser opens and restores it on return; the persisted CSRF state is now the single source of truth (so the ViewModel no longer holds its own copy). Cleared on success.

One deliberate scope note re: "private key behind Android Keystore": this PR persists the DPoP EC key as Base64 PKCS8/X509 in EncryptedSharedPreferences — i.e. encrypted at rest via the Keystore master key — which matches how the live session key is already stored in OAuthSessionStore. Generating a fully hardware-backed, non-exportable key would diverge the two key paths, so I left that as a follow-up (noted in the PR) to harden both stores together.

Will auto-close on merge.

Fix up in **PR #32** (`fix/oauth-pending-auth-process-death`). Root cause confirmed: the pending authorization (DPoP key, PKCE verifier, CSRF state, discovery) lived only in memory — on the `AtProtoOAuthClient` singleton and duplicated as `pendingState` in `OAuthLoginViewModel`. Process death during the browser step wiped both, so `completeLogin` threw `No pending auth`. New `PendingAuthStore` persists it to `EncryptedSharedPreferences` before the browser opens and restores it on return; the persisted CSRF state is now the single source of truth (so the ViewModel no longer holds its own copy). Cleared on success. One deliberate scope note re: "private key behind Android Keystore": this PR persists the DPoP EC key as Base64 PKCS8/X509 in EncryptedSharedPreferences — i.e. encrypted at rest via the Keystore master key — which matches how the live session key is already stored in `OAuthSessionStore`. Generating a fully hardware-backed, non-exportable key would diverge the two key paths, so I left that as a follow-up (noted in the PR) to harden both stores together. Will auto-close on merge.

starsetbyte closed this issue

2026-06-21 16:11:56 +00:00

starsetbyte referenced this issue from a commit

2026-06-21 16:11:56 +00:00

Merge pull request 'fix(auth): persist pending OAuth across process death (closes #15)' (#32) from fix/oauth-pending-auth-process-death into main