1.30.1 — Sign in with Apple completes behind Bouncer

2026-09-24

A Bouncer-gated login page no longer challenges a visitor returning from Sign in with Apple, so the sign-in completes instead of looping back to the login page.

Fixed

• Sign in with Apple no longer loops back to a Bouncer-gated login page. Browsers drop the Bouncer pass cookie on Apple's cross-site form POST return, so the landing was challenged and lost its code/state. /begin now records the visitor's Bouncer pass in the OAuth state, and the gated login page admits a return carrying a live state from the same network.
• A Bouncer challenge served on an OAuth return keeps code and state, so passing the check completes the sign-in instead of restarting it.

Upgrade notes

• A state minted by a visitor who never passed Bouncer is still challenged; Bouncer restrictions (blocked, recovery) still apply to returns.