Android app: open a PC behind a sign-in page such as Cloudflare Access #2008

Problem

My PC's Ovis is reachable from outside through a Cloudflare Tunnel protected by Cloudflare Access (https://ovis.example.com → Access sign-in → the PC's Ovis port). In a phone browser this works: Access shows its sign-in, sets its CF_Authorization cookie, and Ovis loads.

The Android app cannot open it. Opening the address gets a 302 to <team>.cloudflareaccess.com; MainActivity holds the redirect back, probes that origin's /api/health?scope=bridge, which is not Ovis, and shows the error page ("It redirected to …, which did not answer as Ovis"). Even past the first page, Capacitor would hand the sign-in's other hosts (the identity provider) to the browser, whose cookies the WebView does not share, so signing in there does not help the app. The same applies to any authenticating reverse proxy in front of Ovis (oauth2-proxy, Authelia, Pomerium and the like).

Proposal

When a redirect of the address being opened leads to an origin that does not answer as Ovis, take it for a sign-in in front of the PC instead of an error:

• Load it in the WebView. It gets no bridge: the bridge stays limited to the PC's own origin, and the sign-in origin is never saved and never becomes the PC.
• Until a page of the PC loads, keep main-frame navigations (the sign-in's pages, the identity provider's, the way back to the PC) in the WebView rather than in the browser, so the sign-in cookie lands in the WebView's store, which onPause already flushes.
• Keep the error page for what the app refuses today: a redirect over public plain http or from https to http (PCStore.insecureHop), and the redirect limit.

Known limit: identity providers that refuse embedded web views (Google sign-in returns disallowed_useragent) still fail; Access's one-time PIN, GitHub and others work. Supporting Google would need the sign-in in a Custom Tab plus a way to hand the token back to the WebView, which I would leave out of this.

I have this working on Android (about 25 lines in MainActivity, plus docs/native-app.md and a changelog fragment), built and tested on a phone against a PC behind Cloudflare Access. I can open the PR if you agree. I cannot build or test iOS, which has the same redirect handling, so that would stay as it is or be a separate change.

Where

Phone, installed app and alerts; Remote PCs; Access, pairing and devices

Where it exists today

Ovis's own web client already works behind Cloudflare Access in any phone browser; only the native app fails. I do not know of a coding-agent app that connects to a self-hosted PC behind such a proxy.

Workarounds and alternatives

• Use the web client in a browser instead of the app.
• Reach the PC over Tailscale instead of through the Cloudflare Tunnel.
• A Cloudflare Access bypass policy for the app's paths, which removes the protection the proxy is there for.