immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-02-05 00:30:57 +03:00
Code Issues 15 Packages Projects Releases 10 Wiki Activity

[BUG] [OIDC] Apps logs out when closed #468

New Issue
Closed
opened 2026-02-04 20:38:05 +03:00 by OVERLORD · 27 comments
OVERLORD commented 2026-02-04 20:38:05 +03:00
Owner
Copy Link

Originally created by @christiaangoossens on GitHub (Dec 3, 2022).

Describe the bug
The mobile app, on Android, logs out whenever the app is closed when using OIDC login. This is independent of token lifetimes.

Task List

Other steps seem not relevant, if necessary let me know 😅

  • I have read thoroughly the README setup and installation instructions.
  • I have included my docker-compose file.
  • I have included my redacted .env file.
  • I have included information on my machine, and environment.

To Reproduce
Steps to reproduce the behavior:

  1. Configure OIDC
  2. Use it to login to the mobile app
  3. Close the mobile app (either force close or swipe up from the task manager)
  4. App is logged out

Expected behavior
App should remain logged in.

Screenshots
Not relevant.

System

  • Phone OS [iOS, Android]: Android
  • Server Version: 1.36.1
  • Mobile App Version: 1.37.1

Additional context
Using Authentik as IdP. Writing this issue on mobile, can add additional info on pc if wanted.

Originally created by @christiaangoossens on GitHub (Dec 3, 2022). <!-- Note: Please search to see if an issue already exists for the bug you encountered. --> **Describe the bug** The mobile app, on Android, logs out whenever the app is closed when using OIDC login. This is independent of token lifetimes. **Task List** Other steps seem not relevant, if necessary let me know 😅 - [x] I have read thoroughly the README setup and installation instructions. - [ ] I have included my `docker-compose` file. - [ ] I have included my redacted `.env` file. - [x] I have included information on my machine, and environment. **To Reproduce** Steps to reproduce the behavior: 1. Configure OIDC 2. Use it to login to the mobile app 3. Close the mobile app (either force close or swipe up from the task manager) 4. App is logged out **Expected behavior** App should remain logged in. **Screenshots** Not relevant. **System** - Phone OS [iOS, Android]: `Android` - Server Version: `1.36.1` - Mobile App Version: `1.37.1` **Additional context** Using Authentik as IdP. Writing this issue on mobile, can add additional info on pc if wanted.
OVERLORD commented 2026-02-04 20:38:24 +03:00
Author
Owner
Copy Link

@alextran1502 commented on GitHub (Dec 4, 2022):

Confirmed

@alextran1502 commented on GitHub (Dec 4, 2022): Confirmed
OVERLORD commented 2026-02-04 20:38:31 +03:00
Author
Owner
Copy Link

@akoyaxd commented on GitHub (Dec 6, 2022):

I can not reproduce with the steps in OP. I use Immich with Authentik as well.
I had the same issue after my phone ran out of battery for a few days, though.

Server Version: 1.37.0
Mobile Version: 1.37.1 (Android)
Authentik: 2022.10.1

@akoyaxd commented on GitHub (Dec 6, 2022): I can not reproduce with the steps in OP. I use Immich with Authentik as well. I had the same issue after my phone ran out of battery for a few days, though. Server Version: 1.37.0 Mobile Version: 1.37.1 (Android) Authentik: 2022.10.1
OVERLORD commented 2026-02-04 20:38:36 +03:00
Author
Owner
Copy Link

@Morethanevil commented on GitHub (Dec 18, 2022):

Sometimes I get logged out and I don't know why. This is annoying 🙁

Android app with standard login (mail / password)

Maybe this is related? 🤔

@Morethanevil commented on GitHub (Dec 18, 2022): Sometimes I get logged out and I don't know why. This is annoying 🙁 Android app with standard login (mail / password) Maybe this is related? 🤔
OVERLORD commented 2026-02-04 20:38:51 +03:00
Author
Owner
Copy Link

@bt90 commented on GitHub (Dec 27, 2022):

Force closing does not trigger a logout for me. But the last app updates via Google Play have always forced me to log in again.

Standard user/password auth
Mobile Version 1.40.0 build.63

@bt90 commented on GitHub (Dec 27, 2022): Force closing does not trigger a logout for me. But the last app updates via Google Play have always forced me to log in again. Standard user/password auth Mobile Version `1.40.0 build.63`
OVERLORD commented 2026-02-04 20:38:54 +03:00
Author
Owner
Copy Link

@alextran1502 commented on GitHub (Dec 29, 2022):

Force closing does not trigger a logout for me. But the last app updates via Google Play have always forced me to log in again.

Standard user/password auth Mobile Version 1.40.0 build.63

Hello, do you mind providing a screen capture of the behavior?

@alextran1502 commented on GitHub (Dec 29, 2022): > Force closing does not trigger a logout for me. But the last app updates via Google Play have always forced me to log in again. > > Standard user/password auth Mobile Version `1.40.0 build.63` Hello, do you mind providing a screen capture of the behavior?
OVERLORD commented 2026-02-04 20:38:56 +03:00
Author
Owner
Copy Link

@bt90 commented on GitHub (Dec 29, 2022):

In both cases I was greeted with a message that a new server version was available. The username and password fields were both blank, but my server URL was pre-filled.

I tried to trigger this by installing an older version and upgrading. Since this is not so easy with the Playstore version, I uninstalled it and installed an older F-droid version instead. However, installing the update did not cause a logout. Unfortunately, I stumbled across another bug, it seems. I now have a few duplicates on my server 😕

@bt90 commented on GitHub (Dec 29, 2022): In both cases I was greeted with a message that a new server version was available. The username and password fields were both blank, but my server URL was pre-filled. I tried to trigger this by installing an older version and upgrading. Since this is not so easy with the Playstore version, I uninstalled it and installed an older F-droid version instead. However, installing the update did not cause a logout. Unfortunately, I stumbled across another bug, it seems. I now have a few duplicates on my server :confused:
OVERLORD commented 2026-02-04 20:39:00 +03:00
Author
Owner
Copy Link

@christiaangoossens commented on GitHub (Dec 29, 2022):

To note, I have not encountered this with password signin, only with SSO.

@christiaangoossens commented on GitHub (Dec 29, 2022): To note, I have not encountered this with password signin, only with SSO.
OVERLORD commented 2026-02-04 20:39:08 +03:00
Author
Owner
Copy Link

@akoyaxd commented on GitHub (Jan 6, 2023):

I could reproduce the issue of OP after updating my Authentik to ~2022.12.1
To fix this I extended the Access Token validity. Does Immich use the refresh token or do you need re login every time it expires?

image

@akoyaxd commented on GitHub (Jan 6, 2023): I could reproduce the issue of OP after updating my Authentik to ~2022.12.1 To fix this I extended the Access Token validity. Does Immich use the refresh token or do you need re login every time it expires? ![image](https://user-images.githubusercontent.com/22196236/211017320-404a4121-d9d3-44b6-9765-eec4586b4993.png)
OVERLORD commented 2026-02-04 20:39:21 +03:00
Author
Owner
Copy Link

@jrasm91 commented on GitHub (Jan 6, 2023):

@akoyaxd We don't use the refresh token and we only the use accessToken once, during login, so I would be surprised if extending the lifetime of the token in Authentik fixes the issue. At the end of the OAuth flow the mobile app gets an Immich issued JWT which (should be) saevd for future requests. No request are made to the OAuth service after that.

@jrasm91 commented on GitHub (Jan 6, 2023): @akoyaxd We don't use the refresh token and we only the use `accessToken` once, during login, so I would be surprised if extending the lifetime of the token in Authentik fixes the issue. At the end of the OAuth flow the mobile app gets an Immich issued JWT which (should be) saevd for future requests. No request are made to the OAuth service after that.
OVERLORD commented 2026-02-04 20:39:24 +03:00
Author
Owner
Copy Link

@akoyaxd commented on GitHub (Jan 6, 2023):

You are right. After testing again, this setting did not change anything. I fear, I just forgot to set the "stay logged in". :S

#1261

@akoyaxd commented on GitHub (Jan 6, 2023): You are right. After testing again, this setting did not change anything. I fear, I just forgot to set the "stay logged in". :S #1261
OVERLORD commented 2026-02-04 20:39:29 +03:00
Author
Owner
Copy Link

@akoyaxd commented on GitHub (Jan 6, 2023):

@christiaangoossens Do you have to reenter the Server URL again? Did you set the "stay logged in" checkbox?

@akoyaxd commented on GitHub (Jan 6, 2023): @christiaangoossens Do you have to reenter the Server URL again? Did you set the "stay logged in" checkbox?
OVERLORD commented 2026-02-04 20:39:40 +03:00
Author
Owner
Copy Link

@bt90 commented on GitHub (Jan 6, 2023):

Hmm. Did we completely rule out the server yet? An invalid token would also trigger a relogin?

@bt90 commented on GitHub (Jan 6, 2023): Hmm. Did we completely rule out the server yet? An invalid token would also trigger a relogin?
OVERLORD commented 2026-02-04 20:39:41 +03:00
Author
Owner
Copy Link

@christiaangoossens commented on GitHub (Jan 6, 2023):

Yep, not sure if I checked the remember. I did always have to re-enter the URL. For some reason it did not occur to me that the remember was also for OAuth instead of only for the form login.

@christiaangoossens commented on GitHub (Jan 6, 2023): Yep, not sure if I checked the remember. I did always have to re-enter the URL. For some reason it did not occur to me that the remember was also for OAuth instead of only for the form login.
OVERLORD commented 2026-02-04 20:39:49 +03:00
Author
Owner
Copy Link

@jrasm91 commented on GitHub (Jan 6, 2023):

Hmm. Did we completely rule out the server yet? An invalid token would also trigger a relogin?

The token lifespan was 7 days up until a recent change (30 days now), but if this was the root cause then this issue would not be unique to OIDC, but apply to password logins as well.

I use OAuth and have no had any problems personally. I did just log back in without checking the Stay logged in checkbox and can confirm that when I did so I had to login again next time I opened the app.

I agree we should remove the Stay logged in box, always save the server endpoint, and make /api optional.

Can anybody confirm that they still have a problem, even when checking the Stay logged in button?

@jrasm91 commented on GitHub (Jan 6, 2023): > Hmm. Did we completely rule out the server yet? An invalid token would also trigger a relogin? The token lifespan was 7 days up until a recent change (30 days now), but if this was the root cause then this issue would not be unique to OIDC, but apply to password logins as well. I use OAuth and have no had any problems personally. I did just log back in without checking the `Stay logged in` checkbox and can confirm that when I did so I had to login again next time I opened the app. I agree we should remove the `Stay logged in` box, always save the server endpoint, and make `/api` optional. Can anybody confirm that they still have a problem, even when checking the `Stay logged in` button?
OVERLORD commented 2026-02-04 20:39:56 +03:00
Author
Owner
Copy Link

@bt90 commented on GitHub (Jan 6, 2023):

Well it happens for me as well and i only use the password login

@bt90 commented on GitHub (Jan 6, 2023): Well it happens for me as well and i only use the password login
OVERLORD commented 2026-02-04 20:40:01 +03:00
Author
Owner
Copy Link

@jrasm91 commented on GitHub (Jan 6, 2023):

Well it happens for me as well and i only use the password login

Can you send a recording of this happening?

@jrasm91 commented on GitHub (Jan 6, 2023): > Well it happens for me as well and i only use the password login Can you send a recording of this happening?
OVERLORD commented 2026-02-04 20:40:14 +03:00
Author
Owner
Copy Link

@bt90 commented on GitHub (Jan 6, 2023):

Sadly, i've not been able to reproduce it as mentioned above.

@bt90 commented on GitHub (Jan 6, 2023): Sadly, i've not been able to reproduce it as mentioned above.
OVERLORD commented 2026-02-04 20:40:19 +03:00
Author
Owner
Copy Link

@jrasm91 commented on GitHub (Jan 6, 2023):

Sadly, i've not been able to reproduce it as mentioned above.

It sounds like your are just experiencing session expression, which used to be 7 days.

@jrasm91 commented on GitHub (Jan 6, 2023): > Sadly, i've not been able to reproduce it as mentioned above. It sounds like your are just experiencing session expression, which used to be 7 days.
OVERLORD commented 2026-02-04 20:40:28 +03:00
Author
Owner
Copy Link

@bt90 commented on GitHub (Jan 7, 2023):

Interesting. Has this changed recently?

@bt90 commented on GitHub (Jan 7, 2023): Interesting. Has this changed recently?
OVERLORD commented 2026-02-04 20:40:30 +03:00
Author
Owner
Copy Link

@jrasm91 commented on GitHub (Jan 7, 2023):

https://github.com/immich-app/immich/releases/tag/v1.40.0_63-dev

#1187

@jrasm91 commented on GitHub (Jan 7, 2023): https://github.com/immich-app/immich/releases/tag/v1.40.0_63-dev #1187
OVERLORD commented 2026-02-04 20:40:35 +03:00
Author
Owner
Copy Link

@bt90 commented on GitHub (Jan 7, 2023):

So i get logged out of the app after a fixed time period?

@bt90 commented on GitHub (Jan 7, 2023): So i get logged out of the app after a fixed time period?
OVERLORD commented 2026-02-04 20:40:40 +03:00
Author
Owner
Copy Link

@jrasm91 commented on GitHub (Jan 7, 2023):

Yes. We're working on changing this to be indefinite with the ability to revoke device access remotely.

@jrasm91 commented on GitHub (Jan 7, 2023): Yes. We're working on changing this to be indefinite with the ability to revoke device access remotely.
OVERLORD commented 2026-02-04 20:40:43 +03:00
Author
Owner
Copy Link

@jrasm91 commented on GitHub (Mar 27, 2023):

I believe this has been fixed. Anyone still facing this issue?

@jrasm91 commented on GitHub (Mar 27, 2023): I believe this has been fixed. Anyone still facing this issue?
OVERLORD commented 2026-02-04 20:40:49 +03:00
Author
Owner
Copy Link

@dugite-code commented on GitHub (Mar 30, 2023):

I tried yesterday with my Authentik server and was logged out when I closed the app

@dugite-code commented on GitHub (Mar 30, 2023): I tried yesterday with my Authentik server and was logged out when I closed the app
OVERLORD commented 2026-02-04 20:40:54 +03:00
Author
Owner
Copy Link

@jrasm91 commented on GitHub (Mar 30, 2023):

What version of the app/server are you running @dugite-code?

@jrasm91 commented on GitHub (Mar 30, 2023): What version of the app/server are you running @dugite-code?
OVERLORD commented 2026-02-04 20:41:04 +03:00
Author
Owner
Copy Link

@dugite-code commented on GitHub (Apr 4, 2023):

@jrasm91 I pulled the container with the release tag so it would have been 1.52.0 as I was testing just a few hour before the 1.52.1 release was announced.

I'll give the newer release a go in a bit and report back

@dugite-code commented on GitHub (Apr 4, 2023): @jrasm91 I pulled the container with the release tag so it would have been 1.52.0 as I was testing just a few hour before the 1.52.1 release was announced. I'll give the newer release a go in a bit and report back
OVERLORD commented 2026-02-04 20:41:15 +03:00
Author
Owner
Copy Link

@christiaangoossens commented on GitHub (Apr 4, 2023):

I believe the issue is fixed too, I have not encountered it anymore with the newer versions.

@christiaangoossens commented on GitHub (Apr 4, 2023): I believe the issue is fixed too, I have not encountered it anymore with the newer versions.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:translation
cli
date-time
documentation
external-library
format
good first issue
needs-answer
nice to have
sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#468
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?