Custom token-based native mobile authentication no longer restores the user session after upgrading to Mendix 11

Mendix 11 introduced a new authentication token mechanism for native and offline-first applications.

In versions before Mendix 10.9/11, session restoration commonly relied on the XASSESSIONID cookie. Some custom implementations used locally stored tokens in combination with clearing and recreating sessions.

Starting with Mendix 11:

• Authentication uses HttpOnly authentication cookies (authtoken and useAuthToken).

• The runtime no longer restores authenticated sessions based solely on XASSESSIONID.

• Authentication state is managed through the new authentication token mechanism.

• Tokens stored in local storage are not evaluated by the Mendix authentication framework.

As a result, custom authentication solutions that rely on local storage tokens and manual session management may no longer function as expected after upgrading.

Update the authentication implementation to use Mendix-supported authentication APIs.

After validating the external authentication token (for example, a One-Time Token or OTT), authenticate the user through the official Mendix sign-in mechanisms instead of manually managing sessions.

Recommended approach:

1. Use the Sign in nanoflow action from NanoflowCommons 5.0.0 or later.

2. Pass the validated user credentials to the action.

3. Set the useAuthToken parameter to True.

4. Allow the runtime to create and manage the required authentication cookies automatically.

Alternatively, use the corresponding Client API authentication methods that generate the required authentication cookies.