littlefox/neokom

Watch

Fork 1

Refreshing web client logs user out #147

New issue

Closed

opened 2026-10-19 09:51:30 +00:00 by littlefox · 3 comments

littlefox commented

2026-10-19 09:51:30 +00:00

Owner

The user gets immediately logged out of the session when refreshing the web page. Instead we want the user to remain logged in.

This is the case for desktop and phone browsers and the PWA

The user gets immediately logged out of the session when refreshing the web page. Instead we want the user to remain logged in. This is the case for desktop and phone browsers and the PWA

littlefox added the

labels

2026-10-19 10:02:36 +00:00

littlefox commented

2026-10-19 10:02:37 +00:00

Author

Owner

Triage: this is how it was built on purpose, not a slip. D-032 (#53) says the browser remembers the name and server but never the password. Protocol A has no login tokens, so after a reload the page has nothing to log in with. Changing that means revising D-032 for the browser, so it's your call. Recorded as D-044.

What we could do:

The relay keeps the session for a while (resume). When the page goes away, the relay keeps the connection to lyskomd open for a few minutes. The page keeps a one-time resume code for the current tab, and on reload it reattaches to the same session.
- No password is stored anywhere.
- It works for a refresh, and for a phone app that was in the background briefly.
- It does not keep you logged in when you open the app tomorrow.
- It needs relay work, and it's the same machinery as the push service in #135.
Remember the password in the browser, opt-in. "Kom ihåg mig" would also keep the password. It would be stored encrypted with a browser key that scripts can't read out.
- It works for everything: reload, closing the tab, the installed app days later, on desktop, phone and iPhone.
- The limit, plainly: the encryption only stops someone casually copying the browser's files. A script running in the page, or someone with your unlocked browser, could still log in as you. That's about the same as letting the browser save the password.
- Logging out removes it, as on desktop.
The browser's own password manager (Credential Management API), which signs in silently. It's safer storage, but only Chrome, Edge and Android have it. No Safari or Firefox, so the iPhone app isn't covered.
Only for the current tab. The password goes in sessionStorage, which a reload keeps and closing the tab or app clears. It's simple and fixes the refresh itself, but not reopening the installed app.

My recommendation: 2 now, since it's the only option that fixes all three cases you listed (desktop browser, phone browser, installed app). Keep it opt-in behind "Kom ihåg mig", with the wording saying the password is kept on this device. Option 1 can follow later with #135, to make reloads instant without logging in again.

Which do you want? (Or "2, but…")

Triage: this is how it was built on purpose, not a slip. D-032 (#53) says the browser remembers the name and server but **never the password**. Protocol A has no login tokens, so after a reload the page has nothing to log in with. Changing that means revising D-032 for the browser, so it's your call. Recorded as D-044. What we could do: 1. **The relay keeps the session for a while (resume).** When the page goes away, the relay keeps the connection to lyskomd open for a few minutes. The page keeps a one-time resume code for the current tab, and on reload it reattaches to the same session. - No password is stored anywhere. - It works for a refresh, and for a phone app that was in the background briefly. - It does *not* keep you logged in when you open the app tomorrow. - It needs relay work, and it's the same machinery as the push service in #135. 2. **Remember the password in the browser, opt-in.** "Kom ihåg mig" would also keep the password. It would be stored encrypted with a browser key that scripts can't read out. - It works for everything: reload, closing the tab, the installed app days later, on desktop, phone and iPhone. - The limit, plainly: the encryption only stops someone casually copying the browser's files. A script running in the page, or someone with your unlocked browser, could still log in as you. That's about the same as letting the browser save the password. - Logging out removes it, as on desktop. 3. **The browser's own password manager** (Credential Management API), which signs in silently. It's safer storage, but only Chrome, Edge and Android have it. No Safari or Firefox, so the iPhone app isn't covered. 4. **Only for the current tab.** The password goes in `sessionStorage`, which a reload keeps and closing the tab or app clears. It's simple and fixes the refresh itself, but not reopening the installed app. **My recommendation:** 2 now, since it's the only option that fixes all three cases you listed (desktop browser, phone browser, installed app). Keep it opt-in behind "Kom ihåg mig", with the wording saying the password is kept on this device. Option 1 can follow later with #135, to make reloads instant without logging in again. Which do you want? (Or "2, but…")

littlefox added this to the 0.4: Find your people milestone

2026-10-19 10:09:33 +00:00

littlefox referenced this issue

2026-10-19 10:09:35 +00:00

Roadmap: review 0.4, with its issues; D-044 #157

littlefox referenced this issue from a commit

2026-10-19 10:09:35 +00:00

Roadmap: review 0.4, with its issues; D-044 for staying logged in on the web

littlefox removed the

needs/user

label

2026-10-19 10:18:16 +00:00

littlefox commented

2026-10-19 10:18:16 +00:00

Author

Owner

Decided (D-045): the password may be kept, but only in the browser's own password manager, never in storage NeoKOM makes itself. Working on it:

Chrome, Edge, Android: the Credential Management API stores the password and signs in silently after a reload. Logging out stops the silent sign-in.
Safari, Firefox, iPhone: there's no such API, so the login form is marked up for the browser's password manager to save and fill. When it fills the form by itself and you chose to stay logged in, NeoKOM logs in. On the iPhone, the Keychain still asks for a tap or Face ID.

Decided (D-045): the password may be kept, but only in the browser's own password manager, never in storage NeoKOM makes itself. Working on it: - Chrome, Edge, Android: the Credential Management API stores the password and signs in silently after a reload. Logging out stops the silent sign-in. - Safari, Firefox, iPhone: there's no such API, so the login form is marked up for the browser's password manager to save and fill. When it fills the form by itself and you chose to stay logged in, NeoKOM logs in. On the iPhone, the Keychain still asks for a tap or Face ID.

littlefox referenced this issue from a pull request that will close it,

2026-10-19 10:29:49 +00:00

Web: stay logged in through the browser's password manager #158

littlefox referenced this issue from a commit

2026-10-19 10:29:50 +00:00

Web: stay logged in through the browser's password manager

littlefox referenced this issue from a commit

2026-10-19 11:04:14 +00:00

Desktop lint: no needless return, unused_async expected

littlefox referenced this issue from a commit

2026-10-19 11:54:17 +00:00

remember.spec: buttons by either language

littlefox closed this issue

2026-10-19 12:21:24 +00:00

littlefox commented

2026-10-19 12:21:32 +00:00

Author

Owner

Merged in #158 (D-045). With 'Håll mig inloggad', the password goes only to the browser's own password manager:

Chrome, Edge, Android: through the Credential Management API, with a silent sign-in on reload. Logging out stops it.
Safari, Firefox, iPhone: through password-manager markup on the form, and a form the browser fills by itself is used.
NeoKOM's own storage never holds the password.

Verified:

remember.spec on desktop, Android and iPhone, with a stand-in password manager for each route;
the full suite in CI, plus the desktop smoke test (keyring path unchanged);
login screenshots.

To try on real devices: tick 'Håll mig inloggad', log in, let the browser save the password, then reload.

Merged in #158 (D-045). With 'Håll mig inloggad', the password goes only to the browser's own password manager: - Chrome, Edge, Android: through the Credential Management API, with a silent sign-in on reload. Logging out stops it. - Safari, Firefox, iPhone: through password-manager markup on the form, and a form the browser fills by itself is used. - NeoKOM's own storage never holds the password. Verified: - remember.spec on desktop, Android and iPhone, with a stand-in password manager for each route; - the full suite in CI, plus the desktop smoke test (keyring path unchanged); - login screenshots. To try on real devices: tick 'Håll mig inloggad', log in, let the browser save the password, then reload.