OIDC: Komga loads inside authentication popup on first login

[spin-drift]

Steps to reproduce

1. Open Komga login page
2. Click "Sign in with OIDC"
3. Authenticate in the popup window
4. After authentication, Komga loads inside the popup, not the main tab
5. When revisiting Komga, it loads fine in the main tab—this happens only on first OIDC authentication

Expected behavior

After authenticating with OIDC in the popup window, Komga should close the popup and reload the main browser tab with the authenticated session (or redirect to Komga in the main tab). The main window should be logged in. Komga should not load in the popup itself.

Actual behavior

Upon first OIDC login, after authenticating, Komga loads inside the popup window rather than closing the popup and updating the main tab. Manually closing the popup and refreshing the main tab works, but the expected behavior would be for Komga to seamlessly update the main window and close the popup automatically.

Logs

No errors in console. This appears to be a client-side issue with popup handling and post-authentication routing. Let me know if you want more diagnostic info.

Komga version

1.24.4

Operating system

Unraid 7.3

Installation method

Docker

Other details

• This behavior is seen in Firefox
• Disabling pop-up blockers had no effect
• Issue is reliably reproducible with the described steps
• If you need dev console output, I can provide it.

Acknowledgements

• I have searched the existing issues (open AND closed) and this is a new ticket, NOT a duplicate or related to another open issue.
• I have written a short but informative title.
• I have checked the FAQ.
• I have updated the app to the latest version.
• I will fill out all of the requested information in this form.

[gotson]

could be a browser issue, it has worked fine for years

[spin-drift]

Sorry, I left out an important detail: I'm using VoidAuth, which is technically supported as a generic OIDC provider, but isn't in the main list of Komga-supported auth providers. So it's possible there's something between the two going on.

[gotson]

you would need to run some troubleshooting on your own, like trying browser in incognito, or without any extension, or trying other browsers. I use Firefox myself, with Google OAuth, and doesn't have the problem.

[Caslus]

@spin-drift, did you end up finding out how to fix this? Facing the same issue here using VoidAuth =/

[denkristoffer]

This looks like an issue in VoidAuth. window.opener gets set to null. When I compare to Authelia, which handles the Komga pop-up as expected, window.opener is set to a Window object.

[denkristoffer]

I found the cause: VoidAuth is served with the header Cross-Origin-Opener-Policy: same-origin, which breaks popup-based OIDC clients where the client opens VoidAuth in a popup and expects the popup to retain window.opener.

To fix it, you can unset the header with your reverse proxy. I use traefik, so for me this means adding new middleware labels on the VoidAuth container:

  - traefik.http.middlewares.voidauth-headers.headers.customResponseHeaders.Cross-Origin-Opener-Policy=
  - traefik.http.routers.voidauth.middlewares=voidauth-headers

That should do it 👍

[Caslus]

That was it, fixed it for me as well :)
Here's an example reverse proxy config for Caddy:

auth.example.com {
    reverse_proxy voidauth:3000 {
        header_down -Cross-Origin-Opener-Policy
    }
}

[JohnNash]

Interesting. I came across this post while troubleshooting the same problem when using PocketID. I'll move to Caddy.

[denkristoffer]

The issue in VoidAuth has been fixed in the latest release, by the way.