Repository navigation
fix(android): launch auth in CustomTab - #10371
Conversation
Unfortunately, Firefox on Android seems to have a bug where it only allows one tab to intercept the custom URI scheme handler for our auth redirect. This causes an issue where the first sign in works, but subsequent ones do not because that first tab is still open. Luckily the fix here is quite simple. By using Android's CustomTabs to launch the activity, only one, sandboxed instance is ever open and the URI intercept works reliably. Both Firefox and Chrome (and likely other browsers) support CustomTabs, which means the user's default browser is used, allowing cookies, password managers, etc to be used. Related to this, this PR also fixes a bug where dismissing the launched auth flow would result in it immediately relaunching, making it impossible to get back to the app unless you force quit or complete the sign in process. Fixes #10318
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Tested:
|
There was a problem hiding this comment.
Pull Request Overview
This PR fixes authentication issues on Android by implementing CustomTabs for OAuth flows and preventing infinite relaunch loops. The change addresses a Firefox bug where multiple tabs interfere with URI scheme handling, causing subsequent sign-ins to fail.
- Replaces standard browser intent with Android CustomTabs for authentication
- Adds logic to prevent auth flow from relaunching when user dismisses it
- Includes changelog entry documenting the Firefox-specific fix
Reviewed Changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| website/src/components/Changelog/Android.tsx | Adds changelog entry for Firefox sign-in bug fix |
| kotlin/android/app/src/main/java/dev/firezone/android/features/auth/ui/AuthViewModel.kt | Simplifies auth URL construction and removes unused authFlowLaunched variable |
| kotlin/android/app/src/main/java/dev/firezone/android/features/auth/ui/AuthActivity.kt | Implements CustomTabs for auth flow and adds dismissal handling logic |
| } catch (e: Exception) { | ||
| // Fallback to default browser if Custom Tabs unavailable | ||
| val intent = Intent(Intent.ACTION_VIEW, Uri.parse(url)) | ||
| intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK) | ||
| startActivity(intent) | ||
| } |
There was a problem hiding this comment.
The catch block should handle specific exceptions rather than catching all exceptions. Consider catching ActivityNotFoundException specifically, as this is the most likely exception when CustomTabs are unavailable.
| if (hasLaunchedCustomTab) { | ||
| // User returned from Custom Tab without completing auth, navigate back to main app | ||
| navigateToSignIn() | ||
| } else { | ||
| viewModel.onActivityResume() | ||
| } |
There was a problem hiding this comment.
The logic assumes that returning to onResume after launching CustomTab means auth was dismissed, but this could also trigger if the user switches apps and returns. Consider using onNewIntent() to handle the auth callback specifically, or check for the auth result before assuming dismissal.
There was a problem hiding this comment.
I think this is ok - switching to another app and returning while the custom tab is open does not close it.
thomaseizinger
left a comment
thomaseizinger
left a comment
There was a problem hiding this comment.
Nice work. Testing this now on my device.
|
Great fix! This is a much nicer experience because it also doesn't leave that odd "You are signed in" tab behind. |
Unfortunately, Firefox on Android seems to have a bug where it only allows one tab to intercept the custom URI scheme handler for our auth redirect. This causes an issue where the first sign in works, but subsequent ones do not because that first tab is still open.
Luckily the fix here is quite simple. By using Android's CustomTabs to launch the activity, only one, sandboxed instance is ever open and the URI intercept works reliably. Both Firefox and Chrome (and likely other browsers) support CustomTabs, which means the user's default browser is used, allowing cookies, password managers, etc to be used.
Related to this, this PR also fixes a bug where dismissing the launched auth flow would result in it immediately relaunching, making it impossible to get back to the app unless you force quit or complete the sign in process.
Fixes #10318