Skip to content

fix(auth): resolve 403 errors with browser User-Agent and session cookie sync - #54

Open
TN-1 wants to merge 2 commits into
coulterpeterson:mainfrom
TN-1:fix/auth
Open

fix(auth): resolve 403 errors with browser User-Agent and session cookie sync#54
TN-1 wants to merge 2 commits into
coulterpeterson:mainfrom
TN-1:fix/auth

Conversation

@TN-1

@TN-1 TN-1 commented Jul 28, 2026

Copy link
Copy Markdown
  • Replace non-browser User-Agents with browser-compatible strings across Android, iOS, and floatcli to prevent Cloudflare WAF 403 bot challenges
  • Implement automagic sails.sid session cookie extraction from web authentication sessions (CookieManager on Android, HTTPCookieStorage on iOS)
  • Ensure Cookie: sails.sid= is attached to all authenticated API calls alongside OAuth DPoP/Bearer tokens
  • Fix slash escaping (/ -> /) in DPoP JWT claim proofs in DPoPManager
  • Handle DPoP-Nonce response headers and WWW-Authenticate retry loops
  • Clear invalid auth states on unresolvable 401/403 responses so the UI routes cleanly to login
  • Add session cookie login buttons and fallback dialogs to LoginScreen, TvLoginScreen, and SettingsScreen
  • Update floatcli with auth set-cookie command and browser User-Agent support

Fixes #52

…ails.sid session cookie sync

- Replace non-browser User-Agents with browser-compatible strings across Android, iOS, and floatcli to prevent Cloudflare WAF 403 bot challenges
- Implement automagic sails.sid session cookie extraction from web authentication sessions (CookieManager on Android, HTTPCookieStorage on iOS)
- Ensure Cookie: sails.sid=<value> is attached to all authenticated API calls alongside OAuth DPoP/Bearer tokens
- Fix slash escaping (\/ -> /) in DPoP JWT claim proofs in DPoPManager
- Handle DPoP-Nonce response headers and WWW-Authenticate retry loops
- Clear invalid auth states on unresolvable 401/403 responses so the UI routes cleanly to login
- Add session cookie login buttons and fallback dialogs to LoginScreen, TvLoginScreen, and SettingsScreen
- Update floatcli with `auth set-cookie` command and browser User-Agent support
@TN-1

TN-1 commented Jul 28, 2026

Copy link
Copy Markdown
Author

@coulterpeterson I believe this latest commit will fix the QR code login but it requires changes to be pushed to your prod server.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Can't login on android tv app anymore

1 participant