FormidableLabs / FormidableLabs/react-native-app-auth

Library does not correctly handle app process termination (activity re-creation) within authorize roundtrip

Open
#773 2 comments 2 reactions 0 assignees View on GitHub
issue-accepted
Dominant language
Java
Stars
2.3k
Forks
473
PR merge metrics
No merged PRs in 30d

Description

## Issue

Related to issues #600, #672 and PR #743

TL;DR Library holds some references in instance variables in RNAppAuthModule. When app process restarts (is stopped in background) when custom browser tab is displayed those instance variables are lost when new process is created. It always results in failed authorization, but sometimes application also crashes when accessing those uninitialized instance variables.

### How to reproduce

1. Start authentication within your application
2. When custom browser tab is displayed kill application with `adb shell am kill com.app` (browser tab stays visible)
3. Finish authentication within browser tab

After authentication roundtrip if finished application process cold starts. There might be two outcomes depending if authorization Activity is correctly resumed or not. But both effectively result in failed authorization.

- Usually application just starts in it's initial state because activity was not resumed (caused by react native bug https://github.com/facebook/react-native/issues/30277)
- Application crashes with some null reference exception when activity resumes correctly

### Details

If mentioned [react native bug](https://github.com/facebook/react-native/issues/30277) is worked around with some [method like this](https://github.com/HugoGresse/react-native-issue-30277/blob/main/PATCH-react-native-image-crop-picker.md) and all Activity results are delivered to application the outcome changes and application crash is now deterministic on null reference exceptions.

There is also [more discussion](https://github.com/HugoGresse/react-native-issue-30277/blob/main/README.md) about this react native bug, and also some other library approaches - https://github.com/react-native-image-picker/react-native-image-picker/issues/1502

### Possible fix discussion

To my understanding this will not be possible to correctly support authorization continuation after cold start without somewhat changing library api surface. There are multiple issues here.

**Deliver activities from last session to javascript**

We need another way how to deliver resumed startup activity results (RNAppAuthModule/onActivityResult) to javascript code as original authorize() Promise is already long lost and javascript was started from scratch after new application process was created.

I currently do use something like this in my workaround to deliver authorize results to application if no authorize() promise is available...

```javascript
export function subscribeAuthorizeResultCallback(callback: (error?: Error, data?: AuthorizeResult) => void): Promise
```

**Flow contextual information to onActivityResult**

There is no easy way how to flow contextual information from RNAppAuthModule/authorize to RNAppAuthModule/onActivityResult in case of process restart. It seems AppAuth-android library currently does not support flowing any custom information through result Intent.

Some values might be read from AuthorizationResponse.request that is available, but there are still some others like clientSecret, dangerouslyAllowInsecureHttpRequests that we need there.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.