title: OIDC and PWA (add to home screen)
body: <p>Update: Basically the same issue as <a href="https://stackoverflow.com/questions/46411192/standalone-pwa-breaks-login">Standalone PWA breaks login</a> but on iOS.</p>
  
  <p>If you add a web app to the home screen, Chrome on android shares the local storage with the same domain in the browser. You can test this by going to <a href="https://wilfrem.github.io/add_to_homescreen_test/" rel="nofollow noreferrer">https://wilfrem.github.io/add_to_homescreen_test/</a> then adding to home screen and see you have the same id when opened from home screen. (I did Nexus 5x)</p>
  
  <p>If you do the same in iOS Safari you get a new id. (i did iPod iOS 12.1.1)</p>
  
  <p>The oidc-client-js library sets a session reference in local storage and then recalls that on the web app
  s signin callback. So if you try to log in from a web app opened from the home screen on iOS, it opens the OP (oidc provider) in Safari, then redirects back the web app's url, but in Safari not the opened from home screen web app, so because of the different local storage you get:</p>
  
  <blockquote>
    <p>No matching state found in storage</p>
  </blockquote>
  
  <p>How are you supposed to use oidc with an iOS opened from home screen web app if the local storage isn't shared across the same domain? Or how do I get iOS to reopen the correct window(the one opened from home screen) when redirecting back to the web app? Or how to I get iOS to never leave the fullscreen app when navigating to the OP (oidc provider) in the first place?</p>
  
  <p>edit:</p>
  
  <p>Here is a narrative to explain the issue.</p>
  
  <ul>
  <li>open <code>my.app.com</code></li>
  <li>add to home screen</li>
  <li>open app from home screen</li>
  <li>click login button</li>
  <li>login button calls <a href="https://github.com/IdentityModel/oidc-client-js/blob/dev/src/UserManager.js#L89" rel="nofollow noreferrer"><code>UserManager.signinRedirect()</code></a></li>
  <li><code>UserManager.signinRedirect()</code> calls <a href="https://github.com/IdentityModel/oidc-client-js/blob/d68661dfb5fce3dc60bb0125843f341398387542/src/OidcClient.js#L41" rel="nofollow noreferrer"><code>OidcClient.createSigninRequest()</code></a></li>
  <li><code>OidcClient.createSigninRequest()</code> stores signin state in localstorage and navigates to <code>my.op.com</code> <a href="https://github.com/IdentityModel/oidc-client-js/blob/d68661dfb5fce3dc60bb0125843f341398387542/src/OidcClient.js#L91-L93" rel="nofollow noreferrer">see</a> <em>on android <code>my.op.com</code> opens a Chrome tab and on iOS <code>my.op.com</code> opens Safari</em></li>
  <li>complete signin process on op</li>
  <li>op redirects to <code>my.app.com/signin-callback.html</code> <em>here is the problem</em></li>
  </ul>
  
  <p>On android <code>my.app.com/signin-callback.html</code> opens in the app opened from the home screen, on iOS it stays in Safari. So you get:</p>
  
  <blockquote>
    <p>No matching state found in storage</p>
  </blockquote>
  
  <p>I'm not having difficulty with the error, based on what is happening the error is completely expected, I just don't know how to get Safari to behave in a way that will work with the library.</p>
  
  <p>If its relevant this is my manifest.json</p>
  
  <pre><code>{
    "name": "omitted",
    "short_name": "omitted",
    "theme_color": "#omitted",
    "background_color": "#omitted",
    "display": "standalone",
    "scope": "/",
    "start_url": "/",
    "icons": [
      {
        "src": "omitted",
        "sizes": "192x192",
        "type": "image/png"
      },
      {
        "src": "omitted",
        "sizes": "512x512",
        "type": "image/png"
      }
    ]
  }
  </code></pre>
  
  <p>add also removed <code>scope</code> but didn't have any change, in behavior.</p>
  
  <p>update:
  also tried setting start to full domain, not just relative <code>/</code>, still no change.</p>