Can't get session in vision os 2.0 beta

[sapoepsilon]

Bug report

• [ ] I confirm this is a bug with Supabase, not with my own application.
• [x] I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

Can't get session in try await Supabase.client.auth.session(from: modifiedURL) the bug only happens in VisionOS 2.0 and works normally on the older versions.

I get the following response:

"invalid flow state, no valid flow state found", code: Optional(404), error: nil, errorDescription: nil, weakPassword: nil))

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

1. Login with oAuth
2. Try to get the session
3. See error

Expected behavior

A session should be retrieved from url with token

Screenshots

If applicable, add screenshots to help explain your problem.

System information

• OS: [VisionOS Developer beta 7]
• Version of supabase: 2.16.1

Additional context

It is probably vision os beta error, I am mainly positing if anybode else has had this error.

[grdsdev]

Hi,

That doesn't seem as a visionOS error, it is a error thrown by Auth server, maybe visionOS behaves differently, I don't have experience with it.

I can setup an app to reproduce the issue, or If you can provide an example app to reproduce this issue, that would be faster.

Thanks!

[sapoepsilon]

Hi,

That doesn't seem as a visionOS error, it is a error thrown by Auth server, maybe visionOS behaves differently, I don't have experience with it.

I can setup an app to reproduce the issue, or If you can provide an example app to reproduce this issue, that would be faster.

Thanks! Hey, apologies, but I missed this comment somehow. I can upload an example app if you would like to but the bug happens in iOS 18 as well.

After some investigation, it seems the issue only affects users who signed up using the Google provider when trying to log in with OAuth. If I sign in with Google OAuth using a Gmail account that registered with a regular email sign-up, I can log in successfully. However, users who signed up directly with Google are experiencing the bug.

[sapoepsilon]

Example code:

func getGoogleSignInURL() -> URL? {
    do {
        url = try client.auth.getOAuthSignInURL(
            provider: .google,
            redirectTo: URL(string: "URLREDIRECT")
        )
    } catch {
        logger.error("Google sign-in failed: \(error.localizedDescription)")
        alertMessage = error.localizedDescription
        showingAlert = true
    }
    return url
}

Button(action: {
    Task {
        do {
            logger.log("Google sign-in button tapped.")
            guard let url = try viewModel.getGoogleSignInURL() else {
                return
            }
            let urlWithToken = try await webAuthenticationSession.authenticate(
                using: url,
                callbackURLScheme: "URLSCHEME"
            )
            logger.info("opening url: \(urlWithToken)")
            Task {
                do {
                    viewModel.session = try await client.auth.session(from: urlWithToken)
                    viewModel.isAuthenticated = true
                    userEmail = viewModel.session?.user.email ?? "No user found"
                } catch {
                    viewModel.alertMessage = error.localizedDescription
                    viewModel.showingAlert.toggle()
                }
            }
        } catch {
            logger.error("Google sign-in failed: \(error)")
        }
    }
}, label: {
    HStack {
        Image("google_logo")
            .resizable()
            .frame(width: 20, height: 20)
        Text("Sign in with Google")
            .fontWeight(.semibold)
    }
    .frame(minWidth: 0, maxWidth: .infinity)
    .padding()
    .foregroundColor(colorScheme == .dark ? .black : .white)
    .background(colorScheme == .dark ? Color.white : Color.black)
    .cornerRadius(10)
})
.accessibilityIdentifier("googleSignInButtonIdentifier")

Logs:

Error checking session: api(Auth.AuthError.APIError(msg: Optional("invalid flow state, no valid flow state found"), code: Optional(404), error: nil, errorDescription: nil, weakPassword: nil)) remote logger: Error, Optional(Dictionary.Keys(["Checking session"])) Optional(Dictionary.Values(["invalid flow state, no valid flow state found"]))

[sapoepsilon]

I fixed the issue. It turns out that getOAuthSignInURL() returns redirecturl?code=[uuid]%23. Removing %23 (the encoded # symbol) solved the problem.