Session issues on iOS

Questions & Help Questions
, , , ,
1

Hi, I’m slowly losing my mind about a bug with liveview on iOS.

Users on my application are members of organizations, and the homepage is the organization’s page. If a user is logged in and a member of the organization, it gets redirected to the management side of the application. This part of the application is protected with the standard plugs and mount hooks to check if the user is logged in, a member and have the required permissions.

Some users cannot access the management page on iOS because they are trapped in a redirect loop, and I cannot find what causes this issue. I’m almost certain it affects only iOS users, and I could not reproduce the bug on LambdaTest, on any version of iOS.

Here are the interesting part of my router:

# Routes unavailable to authenticated users
scope "/", NyghtWeb do
  pipe_through [:browser, :redirect_if_user_is_authenticated]

  live_session :redirect_if_user_is_authenticated,
    on_mount: [OrganizationHook, {NyghtWeb.UserAuth, :redirect_if_user_is_authenticated}],
    session: {Session, :session, []} do
    live "/users/log_in", UserLive.Login, :new
  end

  post "/users/log_in", UserSessionController, :create
end

# Routes requiring authentication
scope "/app", NyghtWeb do
  pipe_through [:browser, :require_authenticated_user]

  live_session :require_authenticated_org_user,
    on_mount: [OrganizationHook, {NyghtWeb.UserAuth, :ensure_authenticated}],
    layout: {NyghtWeb.UI.Layouts, :app_admin},
    session: {Session, :session, []} do

    scope "/events", EventLive do
      live "/", IndexList, :upcoming
    end
end

# Routes that don't require authentication
scope "/", NyghtWeb do
  pipe_through [:browser]

  live_session :optional_authenticated_user,
    on_mount: [OrganizationHook, {NyghtWeb.UserAuth, :mount_current_user}],
    session: {Session, :session, []} do
    live "/", OrganizationLive.Show, :index, as: :home
  end
end

Here are some of the liveview on_mount hooks:

# redirects a user if it's a member of the organization, used on the homepage
def on_mount(:redirect_if_user_is_member, _params, session, socket) do
  socket = mount_current_user(socket, session)

  with {:ok, user} <- Map.fetch(socket.assigns, :current_user),
       true <- Organizations.member?(socket.assigns.current_organization, user) do
    Logger.info("Redirecting user, page is not available for organization member (LV)")
    {:halt, Phoenix.LiveView.redirect(socket, to: ~p"/app/events")}
  else
    _ ->
      {:cont, socket}
  end
end

# generated by phx.gen.auth with added logging
def on_mount(:ensure_authenticated, _params, session, socket) do
  socket = mount_current_user(socket, session)

  if socket.assigns.current_user do
    {:cont, socket}
  else
    Logger.warning("Current user not found, unauthorized access (LV)")

    socket =
      socket
      |> Phoenix.LiveView.put_flash(:error, "You must log in to access this page.")
      |> Phoenix.LiveView.redirect(to: ~p"/users/log_in")

    {:halt, socket}
  end
end

# also generated with phx.gen.auth with added logging
def redirect_if_user_is_authenticated(conn, _opts) do
  if conn.assigns[:current_user] do
    Logger.info("Redirecting user, page is not available for authenticated users (plug)")

    conn
    |> redirect(to: signed_in_path(conn))
    |> halt()
  else
    conn
  end
end

Finally, here are some logs when a user is stuck in a loop:

[INFO] GET /
[INFO] Redirecting user, page is not available for organization member (LV)
[INFO] Sent 302 in 13ms
[INFO] GET /app/events
[INFO] Sent 200 in 28ms
[INFO] CONNECTED TO Phoenix.LiveView.Socket in 22µs Transport: :websocket Serializer: Phoenix.Socket.V2.JSONSerializer parameters: %{"_csrf_token" => "<token>", "_live_referer" => "undefined", "_mounts" => "0", "_track_static" => %{"0" => "...", "1" => "..."}, "timezone" => "Europe/Zurich", "vsn" => "2.0.0"}
[WARN] Current user not found, unauthorized access (LV)
[INFO] GET /users/log_in
[INFO] Redirecting user, page is not available for authenticated users (plug)
[INFO] Sent 302 in 5ms
[INFO] GET /
...

Does anybody have an idea of what’s happening?

Thanks!