Fix Android/TV Floatplane 403s via DPoP nonce handling#53
Open
kubo6472 wants to merge 2 commits into
Open
Conversation
Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Jakub Doboš <kubo6472@users.noreply.github.com>
Floatplane tightened DPoP nonce enforcement; Android never handled use_dpop_nonce (iOS did since Dec 2025), so authenticated calls returned 403 and AuthInterceptor's refresh-on-every-403 loop amplified into 429s. Also prime sails.sid after TV device login and retry iOS token nonce challenges. Co-authored-by: Jakub Doboš <kubo6472@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #52
Summary
Investigated GitHub issue #52 (login failures + post-login
Creators: 403, Subs: 403/ 429s on TV clients).What changed on the Floatplane side
Probing
auth.floatplane.com/www.floatplane.comshows:We are sorry...error page for client/config failures (matches the login symptom). Device-code start still works forclient_id=floatnative; intermittentinternal errorduring QR approval is on FP’s auth server, not something the app can fully fix.DPoP proof is missingwithout it). Invalid proofs can yield500 unknown_error.notLoggedInErroris what Creators/Subscriptions return when DPoP/session auth fails — matching the Android error string in the issue.cf-mitigated: challenge/ Error 1010) for “bad” User-Agents (e.g.curl/*). App UAs still reach origin JSON from here, but aggressive 403→refresh loops can still produce 429 rate limits.App bug that made this worse
iOS gained DPoP nonce capture/retry in Dec 2025 (
use_dpop_nonce). Android never did.AuthInterceptortreated every 403 as “refresh the token,” which:User-Agenton retriesTV device login also skipped
getSelf()cookie priming that the phone OAuth path does.Fix
DPoP-Nonce, retryuse_dpop_noncebefore refresh, keep User-Agent on retries, ignore Cloudflare HTML challenges for logout/refreshcompleteDeviceLogin()primessails.sidvia/user/selfthen companion loginuse_dpop_nonce(like floatcli); prime user/cookie after device-flow successTest plan
Failed to load subscriptions)Creators: 403, Subs: 403)