fix(pwa): stop the service worker swallowing Authentik OAuth redirects (Google sign-in flicker) - #316
Merged
Merged
Conversation
…s (Google sign-in flicker) "Sign in with Google" just flickered back to the login page. Root cause: the PWA service worker's navigateFallbackDenylist only excluded /api/*, so a full-page navigation to /source/oauth/login/google/ (the app-Ingress-proxied Authentik source-launch) was intercepted by the SW and served the cached SPA shell instead of reaching Authentik → the browser re-booted the app at that URL, found no token, and showed the login page again. curl worked (no SW); the browser didn't (SW). The app Ingress reverse-proxies Authentik's NATIVE paths (/source, /application, /if, /outpost.goauthentik.io, /-) to the IdP (see values-prod authentik.oidc). When those moved app-hosted, this denylist was never updated to match — two lists that must agree, with nothing checking them. Add the Authentik path families to the denylist so social sign-in navigations reach the server. Verified the regexes deny /source/oauth/login/google/ and /api/*, and do NOT deny app routes. NOTE: this fixes Google. Password login has a SEPARATE server-side cause (Authentik responding very slowly → the flow executor times out → "invalid credentials"); tracked separately. Refs #294 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session-Id: f636c22e-1cd7-401e-8843-97e3e3a4ba01
Contributor
Automated code review (gate-code-review)Credit balance is too low Report-only — this check never blocks merge. |
izzywdev
added a commit
that referenced
this pull request
Jul 20, 2026
release.yml built the image (build-and-push succeeded) but deploy-application was SKIPPED because deploy-infrastructure (a stale AWS website Terraform reading a non-existent ELB/ASG) failed and gates it. So the #316 service-worker fix never reached prod. Bump the frontend tag here so Argo (auto-sync on) reconciles it — the same tag bump the skipped job would have done. Frontend-only; other services unchanged. The stale deploy-infrastructure gate is a separate release-pipeline bug to fix so app deploys stop depending on a dead AWS step. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session-Id: f636c22e-1cd7-401e-8843-97e3e3a4ba01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Diagnosed live with the product owner: Sign in with Google flickered back to the login page.
Root cause
The PWA service worker's
navigateFallbackDenylistonly excluded/api/*. A full-page navigation to/source/oauth/login/google/(the app-Ingress-proxied Authentik source-launch) was intercepted by the SW and served the cached SPA shell instead of reaching Authentik. The app re-booted at that URL, found no token, and showed the login page again — the "flicker."curlworked (no SW); the browser did not.The app Ingress reverse-proxies Authentik's native paths (
/source,/application,/if,/outpost.goauthentik.io,/-) to the IdP. When those became app-hosted, this denylist was never updated to match — two lists that must agree, nothing checking them.Fix
Add the Authentik path families to
navigateFallbackDenylist. Verified the regexes deny/source/oauth/login/google/and/api/*, and do not deny app routes like/dashboard.Scope / honesty
This fixes Google sign-in. Password login has a separate server-side cause — Authentik is responding very slowly in prod (measured 6.5s for OIDC discovery, 20s+ for the password flow), so the security service's server-side flow executor times out and reports "invalid credentials." That is not fixed here and is tracked separately (needs Authentik pod/DB health — cluster access).
Deploys the frontend on merge to master.
Refs #294
🤖 Generated with Claude Code