When using Safari with Pangolin + Pocket-ID (OIDC), the login fails with:
"There was a problem connecting to Pocket-ID... The login request is missing state information."
Pangolin sets the p_oidc_state cookie on /auth/login, but Safari does not send it back on the OIDC callback, so Pangolin cannot validate state. Chrome works normally.
2026-01-22T01:11:12+00:00 POST /api/v1/auth/idp/1/oidc/validate-callback
2026-01-22T01:11:12+00:00 State verified {"expectedState":"<redacted>","state":"<redacted>"}
Notes
Pocket-ID /authorize requests succeed in both Safari and Chrome.
This appears to be a Safari cookie handling issue on the Pangolin callback (state cookie not sent).
Environment
Pangolin: fosrl/pangolin:ee-1.14.1
Pocket‑ID: ghcr.io/pocket-id/pocket-id:v2 (2.2.0)
Traefik: traefik:v3.6
Gerbil: fosrl/gerbil:1.3.0
Pangolin URL: https://pangolin.TLD.com
Pocket‑ID URL: https://auth.TLD.com
Safari: Version 26.3 (21623.2.4.11.1)
Chrome: Chromium Engine Version 144.0.7559.60
To Reproduce
Open Safari.
Navigate to https://pangolin.TLD.com.
Select Pocket‑ID as identity provider.
Complete login (passkey, via Apple Password).
Observe error: “missing state information”.
Expected Behavior
OIDC login completes successfully.
Originally created by @thesammykins on GitHub (Jan 22, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2301
Originally assigned to: @miloschwartz on GitHub.
### Describe the Bug
When using Safari with Pangolin + Pocket-ID (OIDC), the login fails with:
"There was a problem connecting to Pocket-ID... The login request is missing state information."
<img width="675" height="455" alt="Image" src="https://github.com/user-attachments/assets/1cedb096-69e6-4432-9f60-34d516e8973b" />
Pangolin sets the `p_oidc_state` cookie on `/auth/login`, but Safari does not send it back on the OIDC callback, so Pangolin cannot validate state. Chrome works normally.
### Evidence (Traefik access logs)
Safari run (fails):
```
2026-01-22T01:10:34.493Z /auth/login ...
Set-Cookie: p_oidc_state=<redacted>; Path=/; Expires=...; Domain=pangolin.TLD.au; HttpOnly; SameSite=lax
2026-01-22T01:10:35.847Z /auth/idp/1/oidc/callback?...
request_Cookie: pangolin-last-org=sammykins-homelab
```
Chrome run (succeeds):
```
2026-01-22T01:11:07.075Z /auth/login ...
Set-Cookie: p_oidc_state=<redacted>; Path=/; Expires=...; Domain=pangolin.TLD.au; HttpOnly; SameSite=lax
2026-01-22T01:11:11.885Z /auth/idp/1/oidc/callback?...
request_Cookie: pangolin-last-org=sammykins-homelab; p_oidc_state=<redacted>
```
### Evidence (Pangolin logs)
Chrome run (success):
```
2026-01-22T01:11:12+00:00 POST /api/v1/auth/idp/1/oidc/validate-callback
2026-01-22T01:11:12+00:00 State verified {"expectedState":"<redacted>","state":"<redacted>"}
```
### Notes
- Pocket-ID `/authorize` requests succeed in both Safari and Chrome.
- This appears to be a Safari cookie handling issue on the Pangolin callback (state cookie not sent).
### Environment
- Pangolin: fosrl/pangolin:ee-1.14.1
- Pocket‑ID: ghcr.io/pocket-id/pocket-id:v2 (2.2.0)
- Traefik: traefik:v3.6
- Gerbil: fosrl/gerbil:1.3.0
- Pangolin URL: `https://pangolin.TLD.com`
- Pocket‑ID URL: `https://auth.TLD.com`
- Safari: Version 26.3 (21623.2.4.11.1)
- Chrome: Chromium Engine Version 144.0.7559.60
### To Reproduce
1. Open Safari.
2. Navigate to `https://pangolin.TLD.com`.
3. Select Pocket‑ID as identity provider.
4. Complete login (passkey, via Apple Password).
5. Observe error: “missing state information”.
### Expected Behavior
OIDC login completes successfully.
@github-actions[bot] commented on GitHub (Feb 6, 2026):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
<!-- gh-comment-id:3857136140 -->
@github-actions[bot] commented on GitHub (Feb 6, 2026):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
@github-actions[bot] commented on GitHub (Feb 21, 2026):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
<!-- gh-comment-id:3937776129 -->
@github-actions[bot] commented on GitHub (Feb 21, 2026):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
Im getting the same error (not necessarily the exact same issue) on FF.
I then need to use an incognito window to get into some services
<!-- gh-comment-id:3977617040 -->
@Vyerni commented on GitHub (Feb 28, 2026):
Im getting the same error (not necessarily the exact same issue) on FF.
I then need to use an incognito window to get into some services
Are you behind cloudflare or anything and what's your config set like for pocketid, I use Authelia myself but no issues here for that. Unless one of you wants to verify within ios so I can get better logging.
<!-- gh-comment-id:4398695170 -->
@AstralDestiny commented on GitHub (May 7, 2026):
Are you behind cloudflare or anything and what's your config set like for pocketid, I use Authelia myself but no issues here for that. Unless one of you wants to verify within ios so I can get better logging.
I'm not behind CF. And it doesn't happen all the time.
All I can tell, it's something with caching. Once I close every site attached to my domain, clear cookies and cache, it appears to work again. I haven't had it show up for about 2-3 weeks currently, so unfortunately I can't test
<!-- gh-comment-id:4404194426 -->
@Vyerni commented on GitHub (May 8, 2026):
I'm not behind CF. And it doesn't happen all the time.
All I can tell, it's something with caching. Once I close every site attached to my domain, clear cookies and cache, it appears to work again. I haven't had it show up for about 2-3 weeks currently, so unfortunately I can't test
Well if someone does have an ios device that will be a test subject let me know. Got no ios devices.
<!-- gh-comment-id:4404299613 -->
@AstralDestiny commented on GitHub (May 8, 2026):
Well if someone does have an ios device that will be a test subject let me know. Got no ios devices.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @thesammykins on GitHub (Jan 22, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2301
Originally assigned to: @miloschwartz on GitHub.
Describe the Bug
When using Safari with Pangolin + Pocket-ID (OIDC), the login fails with:
"There was a problem connecting to Pocket-ID... The login request is missing state information."
Pangolin sets the
p_oidc_statecookie on/auth/login, but Safari does not send it back on the OIDC callback, so Pangolin cannot validate state. Chrome works normally.Evidence (Traefik access logs)
Safari run (fails):
Chrome run (succeeds):
Evidence (Pangolin logs)
Chrome run (success):
Notes
/authorizerequests succeed in both Safari and Chrome.Environment
https://pangolin.TLD.comhttps://auth.TLD.comTo Reproduce
https://pangolin.TLD.com.Expected Behavior
OIDC login completes successfully.
@github-actions[bot] commented on GitHub (Feb 6, 2026):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
@thesammykins commented on GitHub (Feb 6, 2026):
This issue still exists as of 6th Feb 2026.
@github-actions[bot] commented on GitHub (Feb 21, 2026):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
@thesammykins commented on GitHub (Feb 21, 2026):
This is still an issue.
@writzthecat commented on GitHub (Feb 24, 2026):
Happens for me also
@Vyerni commented on GitHub (Feb 28, 2026):
Im getting the same error (not necessarily the exact same issue) on FF.
I then need to use an incognito window to get into some services
@AstralDestiny commented on GitHub (May 7, 2026):
Are you behind cloudflare or anything and what's your config set like for pocketid, I use Authelia myself but no issues here for that. Unless one of you wants to verify within ios so I can get better logging.
@Vyerni commented on GitHub (May 8, 2026):
I'm not behind CF. And it doesn't happen all the time.
All I can tell, it's something with caching. Once I close every site attached to my domain, clear cookies and cache, it appears to work again. I haven't had it show up for about 2-3 weeks currently, so unfortunately I can't test
@AstralDestiny commented on GitHub (May 8, 2026):
Well if someone does have an ios device that will be a test subject let me know. Got no ios devices.