OIDC callback: second attempt to login from IOS safari results in `Must supply serialized macaroon` (`invalid_session`)

### Description

We're encountering a critical issue during the OIDC login flow in our Synapse + oidc-provider setup. When a user logs in once successfully and then tries to log in again — particularly in Safari on iOS — the second attempt consistently fails with the following error from Synapse:

❌ Must supply serialized macaroon
Error code: invalid_session

#### Additional Findings
- This behavior has been observed on Safari on iOS
- We have not yet tested this on Android
- If the user closes Safari completely from the app switcher before attempting the second login, the flow works successfully
- The third attempt to log in is successful — and surprisingly, no OIDC login flow is triggered. The WebView closes immediately and the user is logged in.

### Steps to reproduce

- Open the Matrix app on iOS Safari and initiate login via OIDC (/_matrix/client/v3/login/sso/redirect/oidc-aeternity)
- Complete the OIDC login successfully via wallet (SIWE flow)
- Return to the app and log out or attempt to log in again with the same account
- The second attempt fails with the invalid_session error

### Homeserver

another homeserver

### Synapse Version

v1.129.0

### Installation Method

I don't know

### Database

PostgreSQL

### Workers

Single process

### Platform

VM

### Configuration

_No response_

### Relevant log output

```shell
matrix-synapse[1706237]: 2025-05-20 14:37:46,286 - synapse.rest.client.login - 681 - INFO - GET-827 - Redirecting to https://openid.staging.example.domain/auth?response_type=code&client_id=oidcClientId&redirect_uri=https%3A%2F%2Fserver.staging.example.domain%2F_synapse%2Fclient%2Foidc%2Fcallback&scope=openid+profile&state=FK0wQZ6kvryfJaQiSGixAmjlzVbGjC&nonce=VqAvnNhWeYpSdldeVyU6hLVOnb3QdfWm&code_challenge_method=S256&code_challenge=XsjsudoMEbBlQbxKo8YXy1ZBXLgvPeiEiklc4lCWKUE
May 20 14:37:46 matrix-synapse[1706237]: 2025-05-20 14:37:46,286 - synapse.access.http.8008 - 508 - INFO - GET-827 - 103.89.235.146 - 8008 - {None} Processed request: 0.001sec/-0.000sec (0.000sec, 0.000sec) (0.000sec/0.000sec/0) 0B 302 "GET /_matrix/client/r0/login/sso/redirect/oidc-customchain?redirectUrl=exampledomainstaging://connect?transaction_id%3Dm1020086569.1 HTTP/1.0" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Mobile/15E148 Safari/604.1" [0 dbevts]
May 20 14:38:06 matrix-synapse[1706237]: 2025-05-20 14:38:06,399 - synapse.util.caches.lrucache - 217 - INFO - LruCache._expire_old_entries-44 - Dropped 0 items from caches
May 20 14:38:22 matrix-synapse[1706237]: 2025-05-20 14:38:22,941 - synapse.rest.client.login - 681 - INFO - GET-831 - Redirecting to https://openid.staging.example.domain/auth?response_type=code&client_id=oidcClientId&redirect_uri=https%3A%2F%2Fserver.staging.example.domain%2F_synapse%2Fclient%2Foidc%2Fcallback&scope=openid+profile&state=ArDZWJMrHpcAWrvpCYNmDFbEaY1QrW&nonce=BCwIrMeKI09wWYHYnc9g9mDAZramaTrH&code_challenge_method=S256&code_challenge=ciL6zoYqcp-6AlHXHP90Id2oZOCFU5z4t5eXYzAUbdA
May 20 14:38:22 matrix-synapse[1706237]: 2025-05-20 14:38:22,942 - synapse.access.http.8008 - 508 - INFO - GET-831 - 103.89.235.146 - 8008 - {None} Processed request: 0.001sec/-0.000sec (0.000sec, 0.000sec) (0.000sec/0.000sec/0) 0B 302 "GET /_matrix/client/r0/login/sso/redirect/oidc-customchain?redirectUrl=exampledomainstaging://connect?transaction_id%3Dm259012772.0 HTTP/1.0" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Mobile/15E148 Safari/604.1" [0 dbevts]
May 20 14:38:36 matrix-synapse[1706237]: 2025-05-20 14:38:36,399 - synapse.util.caches.lrucache - 217 - INFO - LruCache._expire_old_entries-45 - Dropped 0 items from caches
May 20 14:38:51 matrix-synapse[1706237]: 2025-05-20 14:38:51,707 - synapse.handlers.oidc - 259 - INFO - GET-834 - Received OIDC callback for IdP oidc-customchain
May 20 14:38:51 matrix-synapse[1706237]: 2025-05-20 14:38:51,788 - synapse.http.client - 442 - INFO - GET-834 - Received response to POST https://openid.staging.example.domain/token: 200
May 20 14:38:51 matrix-synapse[1706237]: 2025-05-20 14:38:51,788 - synapse.handlers.sso - 376 - INFO - GET-834 - Found existing mapping for IdP 'oidc-customchain' and remote_user_id 'ak_24njnsgUjRR4MTr33rML3JAkoUuEMm9fvdXAoX1ujUu4p12Bbr': @ak_24njnsgUjRR4MTr33rML3JAkoUuEMm9fvdXAoX1ujUu4p12Bbr:staging.example.domain
May 20 14:38:51 matrix-synapse[1706237]: 2025-05-20 14:38:51,814 - synapse.access.http.8008 - 508 - INFO - GET-834 - 103.89.235.146 - 8008 - {None} Processed request: 0.107sec/-0.000sec (0.002sec, 0.000sec) (0.000sec/0.025sec/2) 0B 302 "GET /_synapse/client/oidc/callback?code=aZr2UfXVuIwVeZd1NC3T48_AkIPdvDXf_kZC7d018OD&state=ArDZWJMrHpcAWrvpCYNmDFbEaY1QrW&iss=https%3A%2F%2Fopenid.staging.example.domain%2F HTTP/1.0" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15" [0 dbevts]
May 20 14:38:53 matrix-synapse[1706237]: 2025-05-20 14:38:53,044 - synapse.replication.tcp.resource - 214 - INFO - replication_notifier-46 - Streaming: caches -> 33233 (limited: False, updates: 1, max token: 33233)
May 20 14:38:53 matrix-synapse[1706237]: 2025-05-20 14:38:53,050 - synapse.replication.tcp.resource - 214 - INFO - replication_notifier-47 - Streaming: device_lists -> 3210 (limited: False, updates: 1, max token: 3210)
May 20 14:38:53 matrix-synapse[1706237]: 2025-05-20 14:38:53,051 - synapse.handlers.auth - 1004 - INFO - POST-835 - Logging in user @ak_24njnsgUjRR4MTr33rML3JAkoUuEMm9fvdXAoX1ujUu4p12Bbr:staging.example.domain on device FHVCLSGKEN
May 20 14:38:53 matrix-synapse[1706237]: 2025-05-20 14:38:53,055 - synapse.access.http.9093 - 508 - INFO - POST-835 - 192.168.32.14 - 9093 - {None} Processed request: 0.018sec/0.000sec (0.002sec, 0.000sec) (0.001sec/0.013sec/7) 344B 200 "POST /_synapse/replication/device_check_registered/%40ak_24njnsgUjRR4MTr33rML3JAkoUuEMm9fvdXAoX1ujUu4p12Bbr%3Astaging.example.domain/uwUrkFjdrg HTTP/1.1" "Synapse/1.129.0" [0 dbevts]
May 20 14:38:53 matrix-synapse[1706237]: 2025-05-20 14:38:53,424 - synapse.access.http.8008 - 508 - INFO - GET-836 - 103.89.235.146 - 8008 - {@ak_24njnsgUjRR4MTr33rML3JAkoUuEMm9fvdXAoX1ujUu4p12Bbr:staging.example.domain} Processed request: 0.013sec/0.001sec (0.001sec, 0.000sec) (0.001sec/0.012sec/2) 2B 200 "GET /_matrix/client/unstable/thirdparty/protocols HTTP/1.0" "example.domain.staging/1.0 (iPhone15,4; iOS 18.4.1; Scale/3.00)" [0 dbevts]
May 20 14:38:53 matrix-synapse[1706237]: 2025-05-20 14:38:53,425 - synapse.access.http.8008 - 508 - INFO - GET-838 - 103.89.235.146 - 8008 - {@ak_24njnsgUjRR4MTr33rML3JAkoUuEMm9fvdXAoX1ujUu4p12Bbr:staging.example.domain} Processed request: 0.007sec/0.000sec (0.000sec, 0.000sec) (0.000sec/0.001sec/1) 14B 200 "GET /_matrix/client/r0/pushers HTTP/1.0" "example.domain.staging/1.0 (iPhone15,4; iOS 18.4.1; Scale/3.00)" [0 dbevts]
May 20 14:38:53 matrix-synapse[1706237]: 2025-05-20 14:38:53,425 - synapse.access.http.8008 - 508 - INFO - GET-837 - 103.89.235.146 - 8008 - {@ak_24njnsgUjRR4MTr33rML3JAkoUuEMm9fvdXAoX1ujUu4p12Bbr:staging.example.domain} Processed request: 0.015sec/0.001sec (0.000sec, 0.000sec) (0.000sec/0.000sec/1) 171B 200 "GET /_matrix/client/r0/devices/FHVCLSGKEN HTTP/1.0" "example.domain.staging/1.0 (iPhone15,4; iOS 18.4.1; Scale/3.00)" [0 dbevts]
May 20 14:38:54 matrix-synapse[1706237]: 2025-05-20 14:38:54,431 - synapse.handlers.e2e_keys - 888 - INFO - POST-839 - Updating device_keys for device 'FHVCLSGKEN' for user @ak_24njnsgUjRR4MTr33rML3JAkoUuEMm9fvdXAoX1ujUu4p12Bbr:staging.example.domain at 1747751934431
May 20 14:38:54 matrix-synapse[1706237]: 2025-05-20 14:38:54,450 - synapse.replication.tcp.resource - 214 - INFO - replication_notifier-48 - Streaming: device_lists -> 3211 (limited: False, updates: 1, max token: 3211)
May 20 14:38:54 matrix-synapse[1706237]: 2025-05-20 14:38:54,452 - synapse.handlers.e2e_keys - 925 - INFO - POST-839 - Adding one_time_keys dict_keys(['signed_curve25519:AAAAAAAAAAo', 'signed_curve25519:AAAAAAAAACc', 'signed_curve25519:AAAAAAAAAAQ', 'signed_curve25519:AAAAAAAAAAs', 'signed_curve25519:AAAAAAAAABs', 'signed_curve25519:AAAAAAAAABA', 'signed_curve25519:AAAAAAAAAAE', 'signed_curve25519:AAAAAAAAACo', 'signed_curve25519:AAAAAAAAAB8', 'signed_curve25519:AAAAAAAAACw', 'signed_curve25519:AAAAAAAAAA0', 'signed_curve25519:AAAAAAAAAB4', 'signed_curve25519:AAAAAAAAACE', 'signed_curve25519:AAAAAAAAAAU', 'signed_curve25519:AAAAAAAAAAY', 'signed_curve25519:AAAAAAAAACs', 'signed_curve25519:AAAAAAAAAA8', 'signed_curve25519:AAAAAAAAABo', 'signed_curve25519:AAAAAAAAADA', 'signed_curve25519:AAAAAAAAACY', 'signed_curve25519:AAAAAAAAABk', 'signed_curve25519:AAAAAAAAAAI', 'signed_curve25519:AAAAAAAAAB0', 'signed_curve25519:AAAAAAAAAAg', 'signed_curve25519:AAAAAAAAADE', 'signed_curve25519:AAAAAAAAABI', 'signed_curve25519:AAAAAAAAACI', 'signed_curve25519:AAAAAAAAAAk', 'signed_curve25519:AAAAAAAAAAM', 'signed_curve25519:AAAAAAAAAAA', 'signed_curve25519:AAAAAAAAAC0', 'signed_curve25519:AAAAAAAAACM', 'signed_curve25519:AAAAAAAAAAw', 'signed_curve25519:AAAAAAAAACQ', 'signed_curve25519:AAAAAAAAACk', 'signed_curve25519:AAAAAAAAABw', 'signed_curve25519:AAAAAAAAABY', 'signed_curve25519:AAAAAAAAABE', 'signed_curve25519:AAAAAAAAABc', 'signed_curve25519:AAAAAAAAAAc', 'signed_curve25519:AAAAAAAAAA4', 'signed_curve25519:AAAAAAAAABU', 'signed_curve25519:AAAAAAAAABM', 'signed_curve25519:AAAAAAAAAC4', 'signed_curve25519:AAAAAAAAACA', 'signed_curve25519:AAAAAAAAABg', 'signed_curve25519:AAAAAAAAAC8', 'signed_curve25519:AAAAAAAAABQ', 'signed_curve25519:AAAAAAAAACg', 'signed_curve25519:AAAAAAAAACU']) for device 'FHVCLSGKEN' for user '@ak_24njnsgUjRR4MTr33rML3JAkoUuEMm9fvdXAoX1ujUu4p12Bbr:staging.example.domain' at 1747751934431
May 20 14:38:54 matrix-synapse[1706237]: 2025-05-20 14:38:54,460 - synapse.replication.tcp.resource - 214 - INFO - replication_notifier-49 - Streaming: caches -> 33234 (limited: False, updates: 1, max token: 33234)
May 20 14:38:54 matrix-synapse[1706237]: 2025-05-20 14:38:54,464 - synapse.access.http.8008 - 508 - INFO - POST-839 - 103.89.235.146 - 8008 - {@ak_24njnsgUjRR4MTr33rML3JAkoUuEMm9fvdXAoX1ujUu4p12Bbr:staging.example.domain} Processed request: 0.033sec/0.000sec (0.004sec, 0.000sec) (0.002sec/0.025sec/9) 48B 200 "POST /_matrix/client/r0/keys/upload HTTP/1.0" "example.domain.staging/1.0 (iPhone15,4; iOS 18.4.1; Scale/3.00)" [0 dbevts]
May 20 14:38:55 matrix-synapse[1706237]: 2025-05-20 14:38:55,160 - synapse.access.http.8008 - 508 - INFO - POST-840 - 103.89.235.146 - 8008 - {@ak_24njnsgUjRR4MTr33rML3JAkoUuEMm9fvdXAoX1ujUu4p12Bbr:staging.example.domain} Processed request: 0.005sec/0.000sec (0.000sec, 0.000sec) (0.000sec/0.004sec/2) 48B 200 "POST /_matrix/client/r0/keys/upload HTTP/1.0" "example.domain.staging/1.0 (iPhone15,4; iOS 18.4.1; Scale/3.00)" [0 dbevts]
May 20 14:38:55 matrix-synapse[1706237]: 2025-05-20 14:38:55,161 - synapse.replication.tcp.resource - 214 - INFO - replication_notifier-50 - Streaming: caches -> 33235 (limited: False, updates: 1, max token: 33235)
May 20 14:39:04 matrix-synapse[1706237]: 2025-05-20 14:39:04,943 - synapse.access.http.8008 - 508 - INFO - GET-841 - 103.89.235.146 - 8008 - {@ak_24njnsgUjRR4MTr33rML3JAkoUuEMm9fvdXAoX1ujUu4p12Bbr:staging.example.domain} Processed request: 0.000sec/0.000sec (0.000sec, 0.000sec) (0.000sec/0.000sec/0) 2B 200 "GET /_matrix/client/unstable/thirdparty/protocols HTTP/1.0" "example.domain.staging/1.0 (iPhone15,4; iOS 18.4.1; Scale/3.00)" [0 dbevts]
May 20 14:39:04 matrix-synapse[1706237]: 2025-05-20 14:39:04,995 - synapse.http.site - 616 - WARNING - sentinel - forwarded request lacks an x-forwarded-proto header: assuming https
May 20 14:39:04 matrix-synapse[1706237]: 2025-05-20 14:39:04,996 - synapse.access.http.8008 - 508 - INFO - GET-843 - 103.89.235.146 - 8008 - {@ak_24njnsgUjRR4MTr33rML3JAkoUuEMm9fvdXAoX1ujUu4p12Bbr:staging.example.domain} Processed request: 0.002sec/0.000sec (0.000sec, 0.000sec) (0.000sec/0.001sec/1) 14B 200 "GET /_matrix/client/r0/pushers HTTP/1.0" "example.domain.staging/1.0 (iPhone15,4; iOS 18.4.1; Scale/3.00)" [0 dbevts]
May 20 14:39:05 matrix-synapse[1706237]: 2025-05-20 14:39:05,005 - synapse.access.http.8008 - 508 - INFO - POST-842 - 103.89.235.146 - 8008 - {@ak_24njnsgUjRR4MTr33rML3JAkoUuEMm9fvdXAoX1ujUu4p12Bbr:staging.example.domain} Processed request: 0.011sec/0.000sec (0.000sec, 0.000sec) (0.000sec/0.011sec/1) 125B 200 "POST /_matrix/client/unstable/user/@ak_24njnsgUjRR4MTr33rML3JAkoUuEMm9fvdXAoX1ujUu4p12Bbr:staging.example.domain/openid/request_token HTTP/1.0" "example.domain.staging/1.0 (iPhone15,4; iOS 18.4.1; Scale/3.00)" [0 dbevts]
May 20 14:39:05 matrix-synapse[1706237]: 2025-05-20 14:39:05,007 - synapse.replication.tcp.resource - 214 - INFO - replication_notifier-51 - Streaming: caches -> 33236 (limited: False, updates: 1, max token: 33236)
May 20 14:39:05 matrix-synapse[1706237]: 2025-05-20 14:39:05,012 - synapse.replication.tcp.resource - 214 - INFO - replication_notifier-52 - Streaming: caches -> 33237 (limited: False, updates: 1, max token: 33237)
May 20 14:39:05 matrix-synapse[1706237]: 2025-05-20 14:39:05,017 - synapse.replication.tcp.resource - 214 - INFO - replication_notifier-53 - Streaming: caches -> 33239 (limited: False, updates: 2, max token: 33238)
May 20 14:39:05 matrix-synapse[1706237]: 2025-05-20 14:39:05,018 - synapse.replication.tcp.resource - 214 - INFO - replication_notifier-53 - Streaming: caches -> 33239 (limited: False, updates: 1, max token: 33239)
May 20 14:39:05 matrix-synapse[1706237]: 2025-05-20 14:39:05,024 - synapse.replication.tcp.resource - 214 - INFO - replication_notifier-54 - Streaming: device_lists -> 3212 (limited: False, updates: 1, max token: 3212)
May 20 14:39:05 matrix-synapse[1706237]: 2025-05-20 14:39:05,027 - synapse.access.http.8008 - 508 - INFO - POST-844 - 103.89.235.146 - 8008 - {@ak_24njnsgUjRR4MTr33rML3JAkoUuEMm9fvdXAoX1ujUu4p12Bbr:staging.example.domain} Processed request: 0.032sec/0.000sec (0.002sec, 0.001sec) (0.001sec/0.026sec/9) 2B 200 "POST /_matrix/client/v3/logout?user_id=%40ak_24njnsgUjRR4MTr33rML3JAkoUuEMm9fvdXAoX1ujUu4p12Bbr%3Astaging.example.domain HTTP/1.0" "matrix-media-repo" [0 dbevts]
May 20 14:39:13 matrix-synapse[1706237]: 2025-05-20 14:39:13,575 - synapse.handlers.oidc - 251 - ERROR - GET-848 - Invalid session for OIDC callback
May 20 14:39:13 matrix-synapse[1706237]: Traceback (most recent call last):
May 20 14:39:13 matrix-synapse[1706237]: File "/usr/local/lib/python3.12/site-packages/synapse/handlers/oidc.py", line 247, in handle_oidc_callback
May 20 14:39:13 matrix-synapse[1706237]: session_data = self._macaroon_generator.verify_oidc_session_token(
May 20 14:39:13 matrix-synapse[1706237]: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
May 20 14:39:13 matrix-synapse[1706237]: File "/usr/local/lib/python3.12/site-packages/synapse/util/macaroons.py", line 283, in verify_oidc_session_token
May 20 14:39:13 matrix-synapse[1706237]: macaroon = pymacaroons.Macaroon.deserialize(session)
May 20 14:39:13 matrix-synapse[1706237]: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
May 20 14:39:13 matrix-synapse[1706237]: File "/usr/local/lib/python3.12/site-packages/pymacaroons/macaroon.py", line 49, in deserialize
May 20 14:39:13 matrix-synapse[1706237]: raise MacaroonInitException(
May 20 14:39:13 matrix-synapse[1706237]: pymacaroons.exceptions.MacaroonInitException: Must supply serialized macaroon.
May 20 14:39:13 matrix-synapse[1706237]: 2025-05-20 14:39:13,575 - synapse.access.http.8008 - 508 - INFO - GET-848 - 103.89.235.146 - 8008 - {None} Processed request: 0.001sec/-0.000sec (0.000sec, 0.000sec) (0.000sec/0.000sec/0) 8952B 400 "GET /_synapse/client/oidc/callback?code=5m5uSFFRpRXIH9xcARWlxcN4Fceqe2HF5roIeU2fTX3&state=mKy4tT8Hn0zaVHqXOy18TbPSEoBLG5&iss=https%3A%2F%2Fopenid.staging.example.domain%2F HTTP/1.0" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15" [0 dbevts]
```

### Anything else that would be useful to know?

Related issues and threads

- Similar, maybe duplicate of https://github.com/element-hq/synapse/issues/12782
- https://github.com/matrix-org/synapse/issues/12707
- https://github.com/matrix-org/synapse/pull/12723#discussion_r874834174