LotusGuild/cinny
3
0
Fork 0
Code Issues 113 Pull Requests 9 Actions Packages Projects Releases Wiki Activity

Firefox: the app hangs on "Heating up" after login until the persistent-storage prompt is answered #303

New Issue
Closed
opened 2026-10-04 21:36:12 -04:00 by jared · 0 comments
jared commented 2026-10-04 21:36:12 -04:00
Owner
Copy Link
Copy Source

What happens
In Firefox, signing in (or reloading with a saved session) shows "Heating up" and goes no further. No sync starts, the encryption engine never loads, and no IndexedDB store is created.

Why
initClient awaits the persistent-storage request before it creates the client (src/client/initMatrix.ts:42):

// Protect the crypto store from eviction before we create and write to it.
await requestPersistentStorage();   // -> navigator.storage.persist()

Chromium and WebKit answer navigator.storage.persist() immediately (false or true). Firefox shows a permission prompt ("Allow … to store data in persistent storage?") and the promise stays pending until the user answers it. Until then, startup is blocked. If the prompt is dismissed or never noticed, the app never starts.

Verified (Playwright, local Synapse):

firefox  -> navigator.storage.persist(): STILL PENDING after 10 s
chromium -> navigator.storage.persist(): resolved false
webkit   -> navigator.storage.persist(): resolved false

In Firefox the login request succeeds, then nothing happens. The only requests after login are /versions and /.well-known/matrix/client: no .wasm, no /sync, and indexedDB.databases() is empty. The page sits on "Heating up" for 60 s+ (the run stopped there). Chromium and WebKit load normally in the same setup.

Introduced by 45afc9ba (2026-07-07, "request persistent storage on client init (KE-1 mitigation)"). src/index.tsx:84 also calls persist() (not awaited) on every load.

Who: every Firefox user (desktop and Android) on the web app. Low-priority thing to check while fixing: whether a user who previously answered "Allow" or "Block" is unaffected (Firefox then resolves immediately).

Fix: never block startup on it. Fire and forget, or Promise.race([persist(), timeout(1500)]), and keep the existing src/index.tsx best-effort request. KE-1 only needs the request made, not awaited.

Acceptance criteria: add a Playwright Firefox project. Firefox reaches the room list within ~10 s of login, with no permission answered.

Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny 30e2dbcd, cinny-desktop 8f67ec7, element-call 3b0050e8.

**What happens** In Firefox, signing in (or reloading with a saved session) shows **"Heating up"** and goes no further. No sync starts, the encryption engine never loads, and no IndexedDB store is created. **Why** `initClient` awaits the persistent-storage request **before** it creates the client (src/client/initMatrix.ts:42): ```ts // Protect the crypto store from eviction before we create and write to it. await requestPersistentStorage(); // -> navigator.storage.persist() ``` Chromium and WebKit answer `navigator.storage.persist()` immediately (`false` or `true`). **Firefox shows a permission prompt** ("Allow … to store data in persistent storage?") and the promise **stays pending until the user answers it**. Until then, startup is blocked. If the prompt is dismissed or never noticed, the app never starts. **Verified** (Playwright, local Synapse): ``` firefox -> navigator.storage.persist(): STILL PENDING after 10 s chromium -> navigator.storage.persist(): resolved false webkit -> navigator.storage.persist(): resolved false ``` In Firefox the login request succeeds, then nothing happens. The only requests after login are `/versions` and `/.well-known/matrix/client`: no `.wasm`, no `/sync`, and `indexedDB.databases()` is empty. The page sits on "Heating up" for 60 s+ (the run stopped there). Chromium and WebKit load normally in the same setup. **Introduced by** 45afc9ba (2026-07-07, "request persistent storage on client init (KE-1 mitigation)"). `src/index.tsx:84` also calls `persist()` (not awaited) on every load. **Who:** every Firefox user (desktop and Android) on the web app. Low-priority thing to check while fixing: whether a user who previously answered "Allow" or "Block" is unaffected (Firefox then resolves immediately). **Fix:** never block startup on it. Fire and forget, or `Promise.race([persist(), timeout(1500)])`, and keep the existing `src/index.tsx` best-effort request. KE-1 only needs the request made, not awaited. **Acceptance criteria:** add a Playwright **Firefox** project. Firefox reaches the room list within ~10 s of login, with no permission answered. --- _Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny `30e2dbcd`, cinny-desktop `8f67ec7`, element-call `3b0050e8`._
jared added the bugpriority: higharea: auth-session labels 2026-10-04 21:36:12 -04:00
jared closed this issue 2026-10-16 22:36:53 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
a11y
Accessibility: keyboard, screen reader, contrast, motion
 area: appearance
Client area: appearance
 area: auth-session
Client area: auth-session
 area: build-ci
Client area: build-ci
 area: calls
Client area: calls
 area: desktop
Client area: desktop
 area: media
Client area: media
 area: messaging
Client area: messaging
 area: mobile
Client area: mobile
 area: moderation
Client area: moderation
 area: navigation
Client area: navigation
 area: notifications
Client area: notifications
 area: settings
Client area: settings
 area: threads
Client area: threads
 bug
Something is not working
 dependencies
Third-party package versions and advisories
 docs
README / LOTUS_* docs wrong or missing
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 needs-human-review
performance
Re-render storms, leaks, heavy work on hot paths
 planning
priority: critical
Data loss, security hole, or crash on a main path
 priority: high
Broken feature or serious usability problem
 priority: low
Minor issue or polish
 priority: medium
Wrong behaviour in an edge case or notable degradation
 qa
Manual QA: shipped, needs a human in a real environment
 question
More information is needed
 research
security
XSS, unsafe URLs, data leaks, auth/session
 tech-debt
Code health, dead code, fragile patterns
 ux
Usability or visual inconsistency
 wontfix
This won't be fixed
No labels area: auth-session bug priority: high
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
cole (Cole Keller) jared (Jared Vititoe) nathan (Nathan Vititoe)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: LotusGuild/cinny#303