markbates / markbates/goth

`could not find a matching session for this request` only on android device

Open
#582 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
6.6k
Forks
631
PR merge metrics
No merged PRs in 30d

Description

Hello,

I made a website with go for the backend with a simple login system with google :

func GoogleLogin(w http.ResponseWriter, r *http.Request) {
	q := r.URL.Query()
	q.Add("provider", "google")
	r.URL.RawQuery = q.Encode()

	gothic.BeginAuthHandler(w, r)
}

func GoogleCallback(w http.ResponseWriter, r *http.Request) {
	q := r.URL.Query()
	q.Add("provider", "google")
	r.URL.RawQuery = q.Encode()

	user, err := gothic.CompleteUserAuth(w, r)
	if err != nil {
		fmt.Println(err)
		http.Error(w, "Error during authentication", http.StatusInternalServerError)
		return
	}
	dbPool, err := db.GetPool()
	if err != nil {
		http.Error(w, "Can't get db", http.StatusInternalServerError)
		return
	}
	err = auth.SaveUser(dbPool, user, w, r)
	if err != nil {
		fmt.Println(err)
		http.Error(w, "Error during saving user", http.StatusInternalServerError)
		return
	}
	http.Redirect(w, r, "/", http.StatusTemporaryRedirect)
}

And the configuration is the following :

func Init() {
	// Load environment variables
	clientID := os.Getenv("GOOGLE_ID")
	clientSecret := os.Getenv("GOOGLE_SECRET")
	clientCallbackURL := os.Getenv("GOOGLE_CALLBACK_URL")
	sessionSecret := os.Getenv("SESSION_SECRET")

	// Check that all necessary variables are set
	if clientID == "" || clientSecret == "" || clientCallbackURL == "" || sessionSecret == "" {
		log.Fatal("Environment variables (GOOGLE_ID, GOOGLE_SECRET, GOOGLE_CALLBACK_URL, SESSION_SECRET) are required")
	}

	store = sessions.NewCookieStore([]byte(sessionSecret))

	// Set up Google provider for Goth
	goth.UseProviders(google.New(clientID, clientSecret, clientCallbackURL))

	// Configure the session store with the session secret
	store := sessions.NewCookieStore([]byte(sessionSecret))
	gothic.Store = store
}

The problem is that the login phase works perfectly on my computer (even with different IP, clean cache and different browser and even different laptop), but on my android device, I get the error could not find a matching session for this request that occurs on gothic.CompleteUserAuth. I'm sure that the URI are well configured in Google redirect URI and again it works well on my laptop.
How can there be a difference between a computer and a android devices ?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the Android login flow and start at gothic.BeginAuthHandler and gothic.CompleteUserAuth, then inspect how sessions.NewCookieStore and gothic.Store are configured in Init. Compare the session cookie received and returned by the Android device with the working desktop flow. Done means the callback finds the matching session and authentication completes on Android.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.