openvibers/openvibe.mediahub Commits

Sign-in no longer hangs on phones (no Clear-Site-Data on the callback or sign-out) (#166)

OP OpenVibers committed 16 days ago · 47898ea080 · 2 files, +4 −6

* Sign-in no longer hangs on phones: the callback and sign-out stop sending Clear-Site-Data, which Chrome holds (with the session cookie) until the cache is cleared

* The sign-out check expects no Clear-Site-Data

Changes

ddiff --git a/server/auth/sso.js b/server/auth/sso.js
iindex 2f79afd..511c0ca 100644
---- a/server/auth/sso.js
++++ b/server/auth/sso.js
@@@ -234,9 +234,8 @@ function createSso({ config, keys, fetchImpl = globalThis.fetch, now = () => Dat
              try {
                  const data = await tokenGrant({ grant_type: 'authorization_code', code: String(code), redirect_uri: redirectUriFor(req), code_verifier: flow.verifier });
                  setSession(res, data);
--                // Whatever this browser kept of the site was rendered for a guest: drop it, so the page it returns to
--                // (and Back) is drawn for the person who just signed in.
--                res.set('Clear-Site-Data', '"cache"');
++                // No Clear-Site-Data here or on sign-out: Chrome holds such an answer (and the cookies it sets) until the
++                // cache is cleared, which on phones left people on the account chooser with no session (2026-10-28).
                  return res.redirect(next);
              } catch (err) {
                  log.warn('[OpenVibe.MediaHub] sign-in exchange failed:', err.status || '', err.error || '');
@@@ -274,7 +273,6 @@ function createSso({ config, keys, fetchImpl = globalThis.fetch, now = () => Dat
                  }).catch(() => {});
              }
              clearSession(res);
--            res.set('Clear-Site-Data', '"cache"');
              res.cookie(HINT_COOKIE, 'guest', { sameSite: 'lax', secure: config.cookies.secure, httpOnly: false, path: '/', maxAge: 365 * 24 * 60 * 60 * 1000 });
              res.redirect(303, sanitizeNext(req.query.next, config));
          });
ddiff --git a/test/security-session.test.js b/test/security-session.test.js
iindex 5a955ed..d4a559d 100644
---- a/test/security-session.test.js
++++ b/test/security-session.test.js
@@@ -66,9 +66,9 @@ const { signJwt } = require('./helpers/mocks');
          assert.strictEqual(JSON.parse(flow).next, '/v/5902');
      });
  
--    await check('signing out clears what the browser kept of the site', async () => {
++    await check('signing out sends no Clear-Site-Data (Chrome holds such an answer until its cache is cleared: phones hung, 2026-10-28)', async () => {
          const out = await s.get('/auth/logout', { as: staff, headers: { 'sec-fetch-site': 'same-origin' } });
--        assert.strictEqual(out.headers.get('clear-site-data'), '"cache"');
++        assert.strictEqual(out.headers.get('clear-site-data'), null);
      });
  
      await check('another site cannot sign a person out; this site can', async () => {