Native app Google login receives wrong user when web already has kratos session

[Zycon42]

We have web app, electron app, api (unimportant here) and kratos. Kratos is behind a proxy on a webapp so on the same origin. Our electron app is using native app authentication flows with return_session_token_exchange_code=true and system browser OAuth as described here.

The issue is following:

• User is logged into the webapp with a Kratos session cookie
• Native app starts Google login via API flow → gets 422 and redirect_browser_to
• System browser opens → Google redirects back to Kratos
• Kratos sees the existing browser session cookie and reuses it, ignoring the Google login for the native app
• Native app exchanges code → receives wrong identity

I think that kratos should ignore the browser session cookie if it's on the social login callback for the API flows.

I considered following workarounds/solutions to prevent browser from sending cookies on google -> kratos redirect

• use electron BrowserWindow, which is unacceptable from UX standpoint
• use SameSite=Strict for session cookie, but that breaks account linking for the webapp I think
• separate kratos domain just for native app callback. This will require manual rewrite of google url with kratos callback, which is messy.

Do I miss something obvious or have any ideas or recommendations? Thanks.

[vinckr]

Hey @Zycon42

maybe I'm not getting something but why would the browser session cookie be included here at all?
Isn't the flow for your electron app from a completely different (mobile) device, unrelated to the browser session?

in general electron is a bit of a weird case since its technically also a browser under the hood.

[Zycon42]

As I said, google is opened in system browser, where you are already logged in. Using browser window inside electron app is unacceptable UX.

Also security wise it's unacceptable. Sane person doesn't put google credentials into electron window where the app can listen to it. It has to be opened in system browser.

[vinckr]

I understand now.

I think you can use the Google Sign-In SDK in your Electron app to get an id_token directly from Google.

See here: https://www.ory.com/docs/kratos/social-signin/google#using-the-google-sdk-on-native-apps