Oauth2 Failed - Android 15

[Infinil]

Hi, I have been using pocketbase v0.22.19 in my flutter app with dart SDK v0.18.1 and have been relying on authWithOauth2() method. It still works quite well for 'apple' & 'google' both the providers with android 11 or recent iOS versions. But lately I have been noticing "Auth failed" webpage on redirect url if I am using android 15 (whether its physcial device or emulator). Quite often I notice Socket Exceptions which stem from realtime subscribe event for "@oauth2" I believe. Most of the times there are no error logs as well.

Here's my current implementation

class PocketBaseUserAuth extends _$PocketBaseUserAuth {
  late PocketBase pocketbaseInstance;

  @override
  Future<RecordAuth> build() async {
    pocketbaseInstance = ref.watch(pocketBaseInstanceProvider);
    return _authenticateFromStorage();
  }


  // Save auth data to persistent storage
  Future<void> _saveAuthData(PocketBase pb) async {
    final prefs = ref.read(sharedPreferencesProvider);
    await prefs.setString('pb_auth_token', pb.authStore.token);
    await prefs.setString('pb_auth_model', jsonEncode(pb.authStore.model?.toJson() ?? {}));
  }
  
  // Clear stored auth data
  Future<void> _clearStoredAuth() async {
    final prefs = ref.read(sharedPreferencesProvider);
    await prefs.remove('pb_auth_token');
    await prefs.remove('pb_auth_model');
  }


  Future<RecordAuth> _authenticateFromStorage() async {
    final pocketbaseInstance = ref.watch(pocketBaseInstanceProvider);
    final prefs = ref.read(sharedPreferencesProvider);
    
    // Try to load stored auth data
    final storedToken = prefs.getString('pb_auth_token');
    final storedModel = prefs.getString('pb_auth_model');

    if (storedToken != null && storedModel != null) {
      try {
        // Restore the auth store manually
        final modelData = jsonDecode(storedModel);
        pocketbaseInstance.authStore.save(storedToken, modelData);
        // Try to refresh the token to ensure it's still valid
        final authData = await pocketbaseInstance.collection(pocketBaseUsersId).authRefresh();
        
        // Update stored data with refreshed token
        await _saveAuthData(pocketbaseInstance);

        return authData;
      } catch (e) {
        // Token is invalid, clear stored data
        await _clearStoredAuth();
        pocketbaseInstance.authStore.clear();
      }
    }
    
    // No valid auth found
    throw const NotFoundException(message: 'No valid authentication found');
  }


  Future<void> _clearAll() async {
    // Clear stored auth data
    await _clearStoredAuth();
    
    // Clear PocketBase auth
    pocketbaseInstance.authStore.clear();
    
    //Unsub from all realtime connections for no auth mismatch
    pocketbaseInstance.realtime.unsubscribe();
  }

  Future<RecordAuth> _authenticateWithProvider(String providerId) async {
    try {
      print('Starting OAuth authentication...');
      
      final recordAuth = await pocketbaseInstance
          .collection(pocketBaseUsersId)
          .authWithOAuth2(providerId, (url) async {
            print('Launching OAuth URL: $url');
            
            await launchUrl(
              Uri.parse(url.toString()),
              mode: LaunchMode.inAppBrowserView,
            );
          });
      
      print('OAuth completed successfully');
      return recordAuth;
      
    } catch (e) {
      print('OAuth error occurred: $e');
      
      // Wait a moment for any background processes to complete
      await Future.delayed(const Duration(seconds: 3));
      
      // Check if authentication actually succeeded despite the error
      if (pocketbaseInstance.authStore.isValid) {
        print('User is authenticated despite the error!');
        
        // Create a RecordAuth object from the auth store
        return RecordAuth(
          token: pocketbaseInstance.authStore.token,
          record: pocketbaseInstance.authStore.model,
        );
      }
      
      print('Authentication actually failed');
      rethrow;
    }
  }


  Future<void> signIn(AuthProvider authProvider) async {
    // Clear all data
    await _clearAll();

    if (authProvider != AuthProvider.email) {
      final recordAuth = await _authenticateWithProvider(authProvider.name);
      print('reached till here 3');
      _saveAuthData(pocketbaseInstance);
      print('reached till here 4');
      state = AsyncData(recordAuth);
      print('reached till here 5');
    }
  }


  Future<void> signOut() async {
    // Clear all data
    await _clearAll();
    
    // Clear the state
    state = const AsyncValue.error(NotFoundException(), StackTrace.empty);
  }
}

The function in question is _authenticateWithProvider
Any possible solutions or hints on where I am supposed to dig deeper?

Version, etc.

Flutter version 3.29.2 on channel stable
Framework - revision c23637390
Engine - revision 18b71d647a
Tools - Dart 3.7.2 - DevTools 2.42.3
pocketbase: ^0.18.1

[Infinil]

Some docker logs from pocketbase instance

pb | INFO GET /api/collections/users/auth-methods
pb | DEBUG Realtime connection established.
pb | └─ map[clientId:6ttXpTiFjiZHFF9UImeWlregQe4XX5x6pNPsk3o8]
pb | DEBUG Realtime subscriptions updated.
pb | └─ map[clientId:6ttXpTiFjiZHFF9UImeWlregQe4XX5x6pNPsk3o8 subscriptions:[@oauth2]]
pb | INFO POST /api/realtime
pb | DEBUG Realtime connection closed (cancelled request)
pb | └─ map[clientId:6ttXpTiFjiZHFF9UImeWlregQe4XX5x6pNPsk3o8]
pb | DEBUG Missing or invalid OAuth2 subscription client
pb | └─ map[clientId:6ttXpTiFjiZHFF9UImeWlregQe4XX5x6pNPsk3o8 error:No client associated with connection ID "6ttXpTiFjiZHFF9UImeWlregQe4XX5x6pNPsk3o8"]

[ganigeorgiev]

The "Missing or invalid OAuth2 subscription client" indicates that the realtime connection was closed before delivering the OAuth2 response.

Why it may have been closed - I don't know but I don't think it is an issue with the Dart SDK.

There is no information what is _$PocketBaseUserAuth, but make sure the error is not caused by the unsubscribe call under _clearAll.

If you still think that it is a PocketBase issue try to isolate the problem to a plain Dart SDK setup and I'll try to have a look at it but as of now I don't know how to reproduce it (I don't have access to Android 15 either).

[Infinil]

Yes, the _$PocketBaseUserAuth is auto-generated with riverpod. Also commented out the unsubscribe method to make sure that's not causing the issue. I have tried to make it as minimal as possible with flutter app (android 15 emulator tested). Here's the code below

main.dart

import 'package:flutter_riverpod/flutter_riverpod.dart';
import 'package:riverpod_annotation/riverpod_annotation.dart';
// Import your existing files
import '../libraries.dart';
import 'constants.dart';

part 'main.g.dart';

enum AuthProvider { email, google, apple }

@Riverpod(keepAlive: true)
PocketBase pocketBaseInstance(PocketBaseInstanceRef ref) {
  return PocketBase(pocketBaseEndpoint);
}

@Riverpod(keepAlive: true)
class PocketBaseUserAuth extends _$PocketBaseUserAuth {
  late PocketBase pocketbaseInstance;

  @override
  Future<RecordAuth> build() async {
    pocketbaseInstance = ref.watch(pocketBaseInstanceProvider);
    return _authenticateFromStorage();
  }

  Future<void> _saveAuthData(PocketBase pb) async {
    final prefs = ref.read(sharedPreferencesProvider);
    await prefs.setString('pb_auth_token', pb.authStore.token);
    await prefs.setString('pb_auth_model', jsonEncode(pb.authStore.model?.toJson() ?? {}));
  }
  
  Future<void> _clearStoredAuth() async {
    final prefs = ref.read(sharedPreferencesProvider);
    await prefs.remove('pb_auth_token');
    await prefs.remove('pb_auth_model');
  }

  Future<RecordAuth> _authenticateFromStorage() async {
    final pocketbaseInstance = ref.watch(pocketBaseInstanceProvider);
    final prefs = ref.read(sharedPreferencesProvider);
    
    final storedToken = prefs.getString('pb_auth_token');
    final storedModel = prefs.getString('pb_auth_model');

    if (storedToken != null && storedModel != null) {
      try {
        final modelData = jsonDecode(storedModel);
        pocketbaseInstance.authStore.save(storedToken, modelData);
        final authData = await pocketbaseInstance.collection(pocketBaseUsersId).authRefresh();
        await _saveAuthData(pocketbaseInstance);
        return authData;
      } catch (e) {
        await _clearStoredAuth();
        pocketbaseInstance.authStore.clear();
      }
    }
    throw Exception('No valid authentication found');
  }

  Future<void> _clearAll() async {
    // await _clearStoredAuth();
    // pocketbaseInstance.authStore.clear();
    // pocketbaseInstance.realtime.unsubscribe();
  }

  Future<RecordAuth> _authenticateWithProvider(String providerId) async {
    final recordAuth = await pocketbaseInstance.collection(pocketBaseUsersId).authWithOAuth2(
      providerId, 
      (url) async {
        await launchUrl(url, mode: LaunchMode.inAppBrowserView);
      }
    );
    return recordAuth;
  }

  Future<void> signIn(AuthProvider authProvider) async {
    if (authProvider != AuthProvider.email) {
      final recordAuth = await _authenticateWithProvider(authProvider.name);
      await _saveAuthData(pocketbaseInstance);
      state = AsyncData(recordAuth);
    }
  }

  Future<void> signOut() async {
    await _clearAll();
    state = AsyncError(Exception('No valid authentication found'), StackTrace.current);
  }
}

final sharedPreferencesProvider = Provider<SharedPreferences>((ref) => throw UnimplementedError());

Future<void> main() async {
  WidgetsFlutterBinding.ensureInitialized();
  await SystemChrome.setPreferredOrientations([DeviceOrientation.portraitUp]);
  
  runApp(
    ProviderScope(
      overrides: [
        sharedPreferencesProvider.overrideWithValue(await SharedPreferences.getInstance()),
      ],
      child: const MyApp()
    )
  );
}

class MyApp extends StatelessWidget {
  const MyApp({super.key});

  @override
  Widget build(BuildContext context) {
    return const MaterialApp(home: MyHomePage());
  }
}

class MyHomePage extends ConsumerWidget {
  const MyHomePage({super.key});

  @override
  Widget build(BuildContext context, WidgetRef ref) {
    final authState = ref.watch(pocketBaseUserAuthProvider);
    final authNotifier = ref.read(pocketBaseUserAuthProvider.notifier);
    
    return Scaffold(
      appBar: AppBar(title: const Text('Google Auth Test')),
      body: Center(
        child: authState.when(
          data: (recordAuth) => Column(
            mainAxisAlignment: MainAxisAlignment.center,
            children: [
              const Text('✅ Logged In!', style: TextStyle(fontSize: 24)),
              const SizedBox(height: 16),
              Text('Email: ${recordAuth.record?.data['email'] ?? 'N/A'}'),
              Text('Name: ${recordAuth.record?.data['name'] ?? 'N/A'}'),
              const SizedBox(height: 16),
              ElevatedButton(
                onPressed: () => authNotifier.signOut(),
                child: const Text('Sign Out'),
              ),
            ],
          ),
          loading: () => const CircularProgressIndicator(),
          error: (error, stackTrace) => Column(
            mainAxisAlignment: MainAxisAlignment.center,
            children: [
              const Text('Not logged in'),
              const SizedBox(height: 16),
              ElevatedButton.icon(
                onPressed: () => authNotifier.signIn(AuthProvider.google),
                icon: const Icon(Icons.login),
                label: const Text('Sign in with Google'),
              ),
            ],
          ),
        ),
      ),
    );
  }
}

pubspec.yaml

name: testapififteen
description: "A new Flutter project."
# The following line prevents the package from being accidentally published to
# pub.dev using `flutter pub publish`. This is preferred for private packages.
publish_to: 'none' # Remove this line if you wish to publish to pub.dev

# The following defines the version and build number for your application.
# A version number is three numbers separated by dots, like 1.2.43
# followed by an optional build number separated by a +.
# Both the version and the builder number may be overridden in flutter
# build by specifying --build-name and --build-number, respectively.
# In Android, build-name is used as versionName while build-number used as versionCode.
# Read more about Android versioning at https://developer.android.com/studio/publish/versioning
# In iOS, build-name is used as CFBundleShortVersionString while build-number is used as CFBundleVersion.
# Read more about iOS versioning at
# https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
# In Windows, build-name is used as the major, minor, and patch parts
# of the product and file versions while build-number is used as the build suffix.
version: 1.0.0+1

environment:
  sdk: ^3.7.2

# Dependencies specify other packages that your package needs in order to work.
# To automatically upgrade your package dependencies to the latest versions
# consider running `flutter pub upgrade --major-versions`. Alternatively,
# dependencies can be manually updated by changing the version numbers below to
# the latest version available on pub.dev. To see which dependencies have newer
# versions available, run `flutter pub outdated`.
dependencies:
  flutter:
    sdk: flutter

  # The following adds the Cupertino Icons font to your application.
  # Use with the CupertinoIcons class for iOS style icons.
  flutter_riverpod: ^2.3.6
  riverpod_annotation: ^2.1.1
  shared_preferences: ^2.2.1
  riverpod_generator: ^2.3.5
  url_launcher: ^6.2.1
  pocketbase: ^0.18.0
  http: ^1.2.2
  analyzer: ^6.4.1
  intl: ^0.19.0

dev_dependencies:
  flutter_test:
    sdk: flutter
    
  flutter_lints: ^4.0.0
  build_runner: ^2.4.9

# For information on the generic Dart part of this file, see the
# following page: https://dart.dev/tools/pub/pubspec

constants.dart file basically provides colleciton ids and libraries.dart is for imports.

I am not sure if isolating the problem further with dart sdk will make the issue detectable as its not happening on other android versions. The socket closing exception might be related to main activity getting backgrounded (for android 15) but i am not sure.

[ganigeorgiev]

The socket closing exception might be related to main activity getting backgrounded (for android 15) but i am not sure.

Yes that could be the case.

It seems that there were several changes with Android 15. From the Android docs:

Apps targeting Android 15 or higher will default to no longer implicitly granting background activity launch (BAL) privileges to PendingIntents they create. Explicit opt-in is required, in order to do so, these are the options depending if the app is sending or creating PendingIntents...

The PocketBase OAuth2 all-in-one call relies that a realtime connection remains open for the duration of the authentication so that it can receive the auth response without the need of explicit redirects or deep links.

Or in other words, it is required that your app remains running in the background even when a Chrome Custom Tab is opened.

Unfortunately I don't have access to Android 15 or an emulator setup at the moment so I cannot assist you with that but try to play around with the various intents options.

If that doesn't help, then you can always fallback to old OAuth2 handling, aka. "Manual code exchange" (the second tab in https://pocketbase.io/docs/authentication/#authenticate-with-oauth2) but this will require deeplink and could be more cumbersome to setup.

[ganigeorgiev]

An alternative to the url_launcher could be to try https://pub.dev/packages/flutter_custom_tabs as it allows more customization.

[Infinil]

yes, implementing deep link with manual code exchange solved the issue 👍

[utopicnarwhal]

I faced the same issue. It would be nice to add this limitation to the package docs 🙏

[ganigeorgiev]

@utopicnarwhal It is not a PocketBase or SDK limitation but I would consider mentioning it with the next release.

[ganigeorgiev]

For completeness, I think the above error is related to the following behavior change in Android 15:

Background network access restrictions
In Android 15, apps that start a network request outside of a valid process lifecycle receive an exception. Typically, an UnknownHostException or other socket-related IOException. Network requests that happen outside of a valid lifecycle are usually due to apps unknowingly continuing a network request even after the app is no longer active.

To mitigate this exception, ensure your network requests are lifecycle aware and cancelled upon leaving a valid process lifecycle by using lifecycle aware components. If it is important that the network request should happen even when the user leaves the application, consider scheduling the network request using WorkManager or continue a user visible task using Foreground Service.

Again, I don't have Android 15, nor easy emulator setup to test it at the moment in order to confirm it.

[utopicnarwhal]

Yes, I wanted to say that I've tested this and can confirm that the PocketBase sends a lot of GET .../api/realtime requests when the app goes to the background according to my logs. So yeah, just a warning banner in the docs would help the developers that gets the "Auth failed" screen out of nowhere on Android 15+ devices 👍

[apizon]

I don't have an Android 15 available either to test/reproduce the issue but I was working on improving my OAuth flow + trying to anticipate for this issue so just sharing what I found in case it's of use to anyone.

Using flutter_custom_tabs in "bottom sheet" mode does not put the app in background so you can most likely keep using standard authWithOAuth2 flow on Android 15.

Sample code for bottom sheet

import 'package:flutter/material.dart';
import 'package:flutter_custom_tabs/flutter_custom_tabs.dart';

Future<void> launchUrlSheet(BuildContext context, Uri url) async {
  final mediaQuery = MediaQuery.of(context);
  final theme = Theme.of(context);

  return launchUrl(
    url,
    customTabsOptions: CustomTabsOptions.partial(
      configuration: PartialCustomTabsConfiguration.adaptiveSheet(
        initialHeight: mediaQuery.size.height,
        initialWidth: mediaQuery.size.width,
        activitySideSheetMaximizationEnabled: true,
        activitySideSheetDecorationType: CustomTabsActivitySideSheetDecorationType.shadow,
        activitySideSheetRoundedCornersPosition: CustomTabsActivitySideSheetRoundedCornersPosition.top,
        cornerRadius: 16,
      ),
      colorSchemes: CustomTabsColorSchemes.defaults(toolbarColor: theme.appBarTheme.backgroundColor),
    ),
    safariVCOptions: SafariViewControllerOptions.pageSheet(
      configuration: const SheetPresentationControllerConfiguration(
        detents: { SheetPresentationControllerDetent.large },
        prefersGrabberVisible: false,
      ),
      preferredBarTintColor: theme.appBarTheme.backgroundColor,
      preferredControlTintColor: theme.colorScheme.onSurface,
      dismissButtonStyle: SafariViewControllerDismissButtonStyle.close,
    ),
  );
}

Then replace the basic launchUrl from example doc by this

final authData = await pb.collection('users').authWithOAuth2('google', (url) async {
  await launchUrlSheet(context, url)
});

[gurkanucar]

@apizon Thank you, it works