· 10 min read
Your Installed Web App Logs Users Out, and Nothing in Your Code Explains It
On one major mobile platform, a web app installed to the home screen has storage isolated from the browser. The cookie jar, local storage and database are a separate container, so a session established in the browser does not carry into the installed app. Users appear logged out for reasons no server log, token lifetime or cookie attribute accounts for. This covers the storage isolation model, why it presents as an authentication bug, and what it forces in session design.