Signed in, and asked to sign in again — only on phones

On gross.uz you sign in with a face scan — no password. It had been working for months. Then reports started arriving: people signed in, landed in their account, went back to the home page, tapped their profile… and were asked to scan their face again. Only on phones. Never on a laptop.

The obvious assumption was that the login was failing. It wasn't — and that wrong assumption cost me two rounds of fixes.

The logs said the opposite of the complaint

Before changing anything, I pulled the server records for one affected session. They showed something strange: six successful sign-ins in ten minutes, and between them, requests for the user's private data going through perfectly.

That inverted the problem. The person was signed in the entire time. Nothing was rejecting them. The app was showing them a "sign in" button anyway — and each time they obeyed it, it signed them in again, successfully, and then asked once more.

So this was never a login problem. It was the app failing to notice its own user.

Two culprits, hiding behind each other

The first was the row of buttons at the bottom of the screen on phones — the one with Home, Search, Menu, Profile. That bar doesn't exist on a laptop, which is exactly why the bug was phone-only. Its Profile button always opened the sign-in window. It never checked whether you were already signed in, because that check had simply never been written.

The second was worse, and it explained a related complaint: reloading the account page would throw people out to the home page. The sign-in page carried a rule — "if someone arrives here while signed in, sign them out." So any accidental visit, even for a fraction of a second, destroyed a perfectly good session on purpose.

One bug asked the question needlessly. The other punished you for answering it.

The fix was mostly deletion

I didn't add clever logic. I removed the inconsistency:

1. Every place that decides "is this person signed in?" now asks one shared source instead of each having its own opinion. There were four such places, and they had quietly drifted apart.
2. The profile button on phones now does what its own comment always claimed: signed in → go to your account; not signed in → offer to sign in.
3. The sign-in page no longer signs anyone out. Landing on a page is not a request to end your session — only pressing "Log out" is.

What I actually learned

I missed this twice, and the reasons were uncomfortable enough to be worth writing down.

I searched the code for places that checked whether the user was signed in. But the real bug was a place that checked nothing at all — and you cannot find missing code by searching for the code that's missing.

And although "only on phones" was in the very first sentence of the report, I spent two rounds hunting for phone-specific behaviour — and never once opened the site at phone width, where the guilty button is visible immediately.

Now, when a bug is specific to one kind of device, my first move isn't a theory. It's to look at the app on that device. It would have saved two days.