Oauth Login flow is broken in every app, including official Trakt app

[javikr]

Hello,

The Login Flow using Oauth from any app using Trakt API is broken right now.

• If you try to login using email/password the Oauth redirects to the website.
• If you try to login using a third party service such as Apple or Gmail, it appears a 404 error page.

I have tried in the Trakt official app and other third party apps. The same error happens.

Please fix this with priority.

Thank you,

[vladjerca]

@javikr I believe I've identified the root cause of this issue. Can you confirm it's fixed on your side as well?

[Tabonx]

I’ve tried it again, and it worked the first time. After that, it stopped working again. I’ve tried it about 20 times in my app, and it only worked correctly twice. I also tried the official app with all three login flows, and it worked.

I use the SwiftUI webAuthenticationSession:

@Environment(\.webAuthenticationSession) private var webAuthenticationSession

let urlWithToken = try await webAuthenticationSession.authenticate(
    using: externalService.authorizeURL,
    callback: .customScheme(Constants.urlScheme),
    preferredBrowserSession: .ephemeral,
    additionalHeaderFields: [:]
)

openURL(urlWithToken)

where the authorize URL is this:

static var authorizeURL: URL {
    URL(string: "\(authPath)oauth/authorize?response_type=code&client_id=\(clientID)&redirect_uri=\(redirectURI)")!
}

To me, this seems like a redirect issue on Trakt’s side rather than an issue on our side. I haven’t changed how I open the Trakt login screen since I implemented it. Also, the fact that the login screen redirects to app.trakt.tv instead of the redirect URL passed in the URL seems to be the bug.

I don’t see any big difference in the login URL when I look at the proxy results:

https://trakt.tv/oauth/authorize?response_type=code&client_id=TraktAppClientID&redirect_uri=trakt://auth&dark_knight=true&signup=false&prompt=login

https://trakt.tv/oauth/authorize?response_type=code&client_id=EpochAppClientID&redirect_uri=withepochtest://traktcallback

However, I see almost 300 load requests for JavaScript chunks and assets, which do not happen with the official Trakt app.

For example:

URL: https://trakt.tv/_app/immutable/chunks/BhICbPTU2.js

[wq369641177]

[wq369641177]

[vladjerca]

TL;DR: dug back in, three distinct root causes, not one. Earlier deploys only covered the first. Fix staged, deploying shortly.

1. The post-login redirect was sending some apps to the wrong place mid-grant instead of completing the oauth flow. Now skipped for any /oauth/authorize in progress.
2. prompt=login was wiping the session state the recovery path relies on, so the post-login redirect lost track of the in-flight oauth flow. Likely what @javikr kept hitting.
3. Apple's 404 was a SameSite mismatch on the session cookie, so the cross-site callback arrived without it and failed state validation. Broadened the cookie config so it rides along.

On the trakt.tv/_app/immutable/... URL @Tabonx, red herring. Those chunks only live on app.trakt.tv. Most likely HTTP/2 connection coalescing in your proxy view labeling rows by SNI instead of :authority.

The new deployment should be live, please let us know if it works on your end. And thanks to everyone for the back and forth here, the proxy captures, repro details, and the prefersEphemeralWebBrowserSession
finding were what made it possible to actually pin down the three layers underneath. Would've been chasing the wrong thing without it 🙏🏼

[javikr]

Thank you! I confirm it is working fine in my side.

[Tabonx]

I've tried logging in a few times and it seems to be working now. Thank you for the effort you put into tracking this down and fixing it.