Safari drops p_oidc_state cookie on OIDC callback, missing state error #343

New Issue

MrUnknownDE · 2026-04-05T17:06:42+02:00

MrUnknownDE commented

2026-04-05 17:06:42 +02:00

Originally created by @thesammykins on 1/22/2026

Describe the Bug

When using Safari with Pangolin + Pocket-ID (OIDC), the login fails with:
"There was a problem connecting to Pocket-ID... The login request is missing state information."

Pangolin sets the p_oidc_state cookie on /auth/login, but Safari does not send it back on the OIDC callback, so Pangolin cannot validate state. Chrome works normally.

Evidence (Traefik access logs)

Safari run (fails):

2026-01-22T01:10:34.493Z /auth/login ...
Set-Cookie: p_oidc_state=<redacted>; Path=/; Expires=...; Domain=pangolin.TLD.au; HttpOnly; SameSite=lax

2026-01-22T01:10:35.847Z /auth/idp/1/oidc/callback?...
request_Cookie: pangolin-last-org=sammykins-homelab

Chrome run (succeeds):

2026-01-22T01:11:07.075Z /auth/login ...
Set-Cookie: p_oidc_state=<redacted>; Path=/; Expires=...; Domain=pangolin.TLD.au; HttpOnly; SameSite=lax

2026-01-22T01:11:11.885Z /auth/idp/1/oidc/callback?...
request_Cookie: pangolin-last-org=sammykins-homelab; p_oidc_state=<redacted>

Evidence (Pangolin logs)

Chrome run (success):

2026-01-22T01:11:12+00:00 POST /api/v1/auth/idp/1/oidc/validate-callback
2026-01-22T01:11:12+00:00 State verified {"expectedState":"<redacted>","state":"<redacted>"}

Notes

Pocket-ID /authorize requests succeed in both Safari and Chrome.
This appears to be a Safari cookie handling issue on the Pangolin callback (state cookie not sent).

Environment

Pangolin: fosrl/pangolin:ee-1.14.1
Pocket‑ID: ghcr.io/pocket-id/pocket-id:v2 (2.2.0)
Traefik: traefik:v3.6
Gerbil: fosrl/gerbil:1.3.0
Pangolin URL: https://pangolin.TLD.com
Pocket‑ID URL: https://auth.TLD.com
Safari: Version 26.3 (21623.2.4.11.1)
Chrome: Chromium Engine Version 144.0.7559.60

To Reproduce

Open Safari.
Navigate to https://pangolin.TLD.com.
Select Pocket‑ID as identity provider.
Complete login (passkey, via Apple Password).
Observe error: “missing state information”.

Expected Behavior

OIDC login completes successfully.

*Originally created by @thesammykins on 1/22/2026* ### Describe the Bug When using Safari with Pangolin + Pocket-ID (OIDC), the login fails with: "There was a problem connecting to Pocket-ID... The login request is missing state information." <img width="675" height="455" alt="Image" src="https://github.com/user-attachments/assets/1cedb096-69e6-4432-9f60-34d516e8973b" /> Pangolin sets the `p_oidc_state` cookie on `/auth/login`, but Safari does not send it back on the OIDC callback, so Pangolin cannot validate state. Chrome works normally. ### Evidence (Traefik access logs) Safari run (fails): ``` 2026-01-22T01:10:34.493Z /auth/login ... Set-Cookie: p_oidc_state=<redacted>; Path=/; Expires=...; Domain=pangolin.TLD.au; HttpOnly; SameSite=lax 2026-01-22T01:10:35.847Z /auth/idp/1/oidc/callback?... request_Cookie: pangolin-last-org=sammykins-homelab ``` Chrome run (succeeds): ``` 2026-01-22T01:11:07.075Z /auth/login ... Set-Cookie: p_oidc_state=<redacted>; Path=/; Expires=...; Domain=pangolin.TLD.au; HttpOnly; SameSite=lax 2026-01-22T01:11:11.885Z /auth/idp/1/oidc/callback?... request_Cookie: pangolin-last-org=sammykins-homelab; p_oidc_state=<redacted> ``` ### Evidence (Pangolin logs) Chrome run (success): ``` 2026-01-22T01:11:12+00:00 POST /api/v1/auth/idp/1/oidc/validate-callback 2026-01-22T01:11:12+00:00 State verified {"expectedState":"<redacted>","state":"<redacted>"} ``` ### Notes - Pocket-ID `/authorize` requests succeed in both Safari and Chrome. - This appears to be a Safari cookie handling issue on the Pangolin callback (state cookie not sent). ### Environment - Pangolin: fosrl/pangolin:ee-1.14.1 - Pocket‑ID: ghcr.io/pocket-id/pocket-id:v2 (2.2.0) - Traefik: traefik:v3.6 - Gerbil: fosrl/gerbil:1.3.0 - Pangolin URL: `https://pangolin.TLD.com` - Pocket‑ID URL: `https://auth.TLD.com` - Safari: Version 26.3 (21623.2.4.11.1) - Chrome: Chromium Engine Version 144.0.7559.60 ### To Reproduce 1. Open Safari. 2. Navigate to `https://pangolin.TLD.com`. 3. Select Pocket‑ID as identity provider. 4. Complete login (passkey, via Apple Password). 5. Observe error: “missing state information”. ### Expected Behavior OIDC login completes successfully.

MrUnknownDE added the needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating labels 2026-04-05 17:06:43 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#343

Safari drops p_oidc_state cookie on OIDC callback, missing state error #343