Authentication Loop / Sign-In Failure on Mobile Browsers

When attempting to log into ⁠minecraft.net⁠ using a mobile browser (specifically Brave and Safari on iOS), the authentication process fails and loops the user back to the "Sign In or Sign Up" page without successfully authenticating or displaying an error message.

Clearing cookies and website data temporarily allows the browser to trigger the Microsoft account selection/passkey prompt, but upon completing the sign-in step, the website still loops back to the unauthenticated landing page.

Steps to Reproduce

1 Navigate to ⁠minecraft.net⁠ on a mobile device (Brave or Safari browser).

2 Open the navigation menu and select Account -> Sign In.

3 On the "Sign In or Sign Up" page, tap Sign In With Microsoft.

4 (If cookies are cleared): Authenticate via the ⁠login.live.com⁠ portal using saved credentials, FaceID, or passkeys.

5 Watch the redirection loop through ⁠sisu.xboxlive.com⁠ and reload back to ⁠minecraft.net⁠.

6 Open the menu again to verify account status.

Expected Result

The user should be logged into their profile, and the menu under Account should display their authenticated user details/profile options instead of prompting to "Sign In" again.

Actual Result

The website goes through a brief loading state, redirects through the authorization endpoints, and drops the user back onto the Sign In or Sign Up page. The user remains unauthenticated.

Environment & Testing Details

URL: ⁠[https://www.minecraft.net/ ](https://www.minecraft.net/ )⁠

Affected Browsers: Brave Browser, Safari (iOS)

OS: iOS (indicated by native FaceID / Passkey prompts)

Network Status: Mobile Data (4G, Strong Signal)

Authentication Method Tried: Microsoft Account via Saved Passwords / Passkeys (⁠login.microsoft.com⁠ / ⁠login.live.com⁠)

Potential Technical Causes for Developers

Cross-Site Tracking / Cookie Blocking: Aggressive tracking protection on mobile Brave or iOS Safari may be dropping or blocking the authentication tokens/session cookies passed back from ⁠sisu.xboxlive.com⁠ to ⁠minecraft.net⁠.

State/Nonce Mismatch: The OAuth state or callback handshake might be failing silently during the mobile redirect chain, causing the site to reset back to its default signed-out state.