Android – Antiforgery (CSRF) issue with ASP.NET server using flutter_appauth 11.0.0 (HTTP 400) – works fine on iOS

Nobody has claimed this yet.

Hi 👋
I’m currently using the latest flutter_appauth (11.0.0) in my Flutter application.
I’m facing an antiforgery (CSRF) validation issue from my ASP.NET backend. The issue only happens on Android. The same flow works perfectly on iOS.

On Android, the authentication process fails with an HTTP 400 error from the server, which is caused by antiforgery validation failure on the ASP.NET side.

**What’s happening**
- Login flow uses Authorization Code + PKCE.
- ASP.NET server validates antiforgery token.
- On Android, the server responds with HTTP 400 (antiforgery validation failed).
- On iOS, everything works as expected.

**Important observation**
This seems to be related to Chrome Custom Tabs cookie/session handling on Android.
Here’s what I noticed:

1. If I clear Chrome app cache manually from device settings → login works once.
2. On the second login attempt → antiforgery issue returns.
3. Clearing cookies from Flutter side does not fully resolve it.
4. Only clearing Chrome’s cache fixes it temporarily.

**So it strongly looks like a cookie persistence or session mismatch issue in Chrome Custom Tabs.**

**Steps to Reproduce**
1. Install app on Android device
2. Perform login → Works first time (after clearing Chrome cache)
3. Logout
4. Try login again
5. Server returns HTTP 400 (antiforgery validation failure)

**Expected Behavior**
Authentication should consistently work without requiring manual Chrome cache clearing.

**Actual Behavior**
- HTTP 400 returned from ASP.NET server
- Antiforgery validation fails
- Only happens on Android
- Works fine on iOS

**Environment**
- Flutter version: 3.38.9
- Dart version 3.10.8
- flutter_appauth: 11.0.0
- Backend: ASP.NET (with antiforgery validation enabled)
- Android browser: Chrome (Custom Tabs)
- iOS: Works correctly

**Question**
Has anyone experienced antiforgery/cookie persistence issues specifically with Android Chrome Custom Tabs?
Is there a recommended way to:

- Properly clear Custom Tab cookies/session?
- Force fresh authentication session?
- Avoid Chrome-level cookie reuse?

Any guidance would be greatly appreciated 🙏

Start by reproducing the login, logout, and second-login sequence on an Android device using Chrome Custom Tabs, then compare it with the working iOS flow. The issue is done when repeated authentication succeeds without manually clearing Chrome's cache or cookies.

Written by the indexing model from the issue text.