Android: Nextcloud SSO/OIDC login button loops back to 'Connect your account' (WebView blocks any URL containing 'apps')

Mobile apps
1

ONLYOFFICE Mobile: Documents (Android)
Do you want to: Report a bug
Device: Android phone (Android 14/15, Chrome WebView 155)
OS version: Android 14
App version: ONLYOFFICE Documents 9.4.1 (build 731), from Google Play
Mode: Connect to Cloud (Nextcloud)

Summary

Logging in to a Nextcloud server through the Android app is impossible when the Nextcloud login page offers an SSO / OpenID Connect button (Nextcloud user_oidc app, here with Pocket ID as provider). Tapping the SSO button on the Nextcloud login page does nothing except throw the user back to the “Connect your account” page. Username/password login is not an option for SSO users.

Steps to reproduce

  1. Nextcloud 31.0.14 with the user_oidc app (8.11.0) configured; the login page shows an "Log in with " button that links to /apps/user_oidc/login/<id>?redirectUrl=....
  2. In ONLYOFFICE Documents for Android: Connect to cloud → Nextcloud → enter the server URL.
  3. The “Connect your account” page (/index.php/login/flow) appears. Tap “Log in”.
  4. The Nextcloud login page appears (/login?redirect_url=/login/flow/grant?...). Tap "Log in with ".

Expected: the WebView navigates to /apps/user_oidc/login/<id>, Nextcloud redirects to the identity provider, the user authenticates, Nextcloud shows the “Grant access” page, and the app receives the nc://login/... credentials (this works in the desktop editors and in the Nextcloud Android app on the same phone).

Actual: the WebView immediately jumps back to the “Connect your account” page. Nothing is sent to the server: the Nextcloud access log shows the login page being served and, three seconds later, GET /index.php/login/flow again, with no request to /apps/user_oidc/... in between. Repeating the steps loops forever.

Cause

In app_manager/.../ui/fragments/login/NextCloudWebLoginFragment.kt (9.4.0 source):

private const val BACK_PATTERN_1 = "apps"
private const val BACK_PATTERN_2 = "files"
...
override fun handleShouldOverrideUrlLoading(request: WebResourceRequest): Boolean {
    ...
    if (uri.toString().contains(BACK_PATTERN_1) || uri.path?.contains(BACK_PATTERN_2) == true) {
        isClear = true
        clearCookies()
        viewBinding?.webView?.clearHistory()
        viewBinding?.webView?.clearCache(true)
        viewBinding?.webView?.loadUrl(loginUrl, headers)
        return true
    }
    ...
}

Any navigation whose URL contains the substring apps anywhere is treated as “the user ended up in the Files app, restart the login flow”: cookies are cleared and /index.php/login/flow is reloaded. The SSO button links to /apps/user_oidc/login/..., so it is intercepted before the request leaves the phone. The same check would also block the OIDC callback (/apps/user_oidc/code?...) and the provider’s authorize URL (its redirect_uri parameter contains /apps/user_oidc/code), as well as any Nextcloud server whose hostname or path happens to contain “apps”.

Suggested fix

Match only the Files app landing page instead of the substring apps, e.g. uri.path starting with /apps/files or /index.php/apps/files, and do not intercept /apps/user_oidc/, /apps/user_saml/ or /apps/sociallogin/ routes (or, simpler, only intercept navigations that have no redirect_url/stateToken and are not part of the login flow). The nc://login handling can stay as it is.

Workaround for users

On the “Connect your account” page choose “Alternative log in using app password” and use a Nextcloud app password (Settings → Security → Devices & sessions).