From f90b4a09637f951c3856b506b1f3cbf9047e3e6d Mon Sep 17 00:00:00 2001 From: Jeroen Schweitzer Date: Sun, 4 Jan 2026 16:51:39 +0100 Subject: [PATCH] fix: skip silent OIDC on callback page to prevent race condition MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit AuthProvider.build() was initiating silent OIDC while the callback page was processing the auth code, causing PKCE state to be cleared. Now checks if on /callback route and skips silent OIDC initiation. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 --- CHANGELOG.md | 5 +++++ lib/core/auth/auth_provider.dart | 7 +++++++ pubspec.yaml | 2 +- 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4deb9a0..dc1909d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [1.1.5] - 2026-01-04 + +### Fixed +- Race condition in OIDC callback: AuthProvider.build() was initiating silent OIDC while the callback page was processing, causing PKCE state to be cleared. Now skips silent OIDC when on `/callback` route. + ## [1.1.4] - 2026-01-04 ### Fixed diff --git a/lib/core/auth/auth_provider.dart b/lib/core/auth/auth_provider.dart index fdf91a7..51566b2 100644 --- a/lib/core/auth/auth_provider.dart +++ b/lib/core/auth/auth_provider.dart @@ -42,6 +42,13 @@ class AuthNotifier extends _$AuthNotifier { Future build() async { // On web with auth required, use silent OIDC to get JWT if (kIsWeb && AppConfig.requiresAuth) { + // Skip silent OIDC if we're on the callback page (it will handle auth) + final currentUrl = web_utils.getCurrentUrl(); + if (currentUrl.contains('/callback')) { + developer.log('Web: On callback page, skipping silent OIDC', name: 'auth'); + return const AuthState(); + } + // First check if we have stored tokens final storedAuth = await _loadStoredAuth(); if (storedAuth.isAuthenticated && !storedAuth.isTokenExpired) { diff --git a/pubspec.yaml b/pubspec.yaml index aa8d107..2865a6c 100644 --- a/pubspec.yaml +++ b/pubspec.yaml @@ -16,7 +16,7 @@ publish_to: 'none' # Remove this line if you wish to publish to pub.dev # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html # In Windows, build-name is used as the major, minor, and patch parts # of the product and file versions while build-number is used as the build suffix. -version: 1.1.4+1 +version: 1.1.5+1 environment: sdk: ^3.10.4