…pp browsers
Some in-app browsers (e.g. WeChat, Facebook) clear sessionStorage when a
redirect opens in a new window or WebView context. This causes the social
sign-in flow to fail with 'Sign-in session not found.' because the auth
state stored before the redirect is no longer accessible after returning.
Add three internal helpers (getStorageItem, setStorageItem, removeStorageItem)
that transparently mirror social connector state to localStorage. On read, if
sessionStorage is empty, the value is recovered from localStorage and restored
to sessionStorage for consistency. On delete, both storage locations are cleared.
This fixes the login failure reported for in-app browsers while keeping the
normal browser flow unchanged.
Fixes: logto-io#7604
Signed-off-by: Sputnik-MAC <sputnik.mac.001@gmail.com>
Problem
Closes #7604
In certain in-app browsers (e.g. WeChat, Facebook, LINE), sessionStorage is cleared when the OAuth redirect opens in a new window or WebView context. This causes the social sign-in callback to fail with
Sign-in session not found.because the auth state stored before the redirect is no longer accessible after returning.Root cause
storeState,validateState,storeCallbackLink,getCallbackLinkFromStorage, andremoveCallbackLinkFromStorageall write/read exclusively fromsessionStorage. In-app browsers that treat each redirect as a new window context reset sessionStorage between navigations.Fix
Introduce three thin storage helpers in
social-connectors.ts:setStorageItem— writes to bothsessionStorageandlocalStoragegetStorageItem— reads fromsessionStoragefirst; if missing, falls back tolocalStorage, restores it tosessionStorage, and removes the localStorage copyremoveStorageItem— removes from both storesAll existing public functions (
storeState,validateState,storeCallbackLink, etc.) are updated to use these helpers. Logic and public API are otherwise unchanged.Security note: the localStorage copy is short-lived — it is removed immediately after being read back. The state value is a random nonce used only for CSRF protection within the sign-in flow.
Testing