FormidableLabs / FormidableLabs/react-native-app-auth

iOS SSO with ASWebAuthenticationSession and SFSafariViewController

Ouverte
#871 4 commentaires 3 réactions 0 personnes assignées Voir sur GitHub
Langage dominant
Java
Étoiles
2.3k
Forks
473
Métriques de merge des PR
Aucune PR mergée en 30 j

Description

## Issue

We have a native application that we're prototyping which needs to:

Authenticate a User to fetch an Access Token as a public client via OIDC (OAUTH2)
Render Web Content, in-app, from our web site which is protected by the same IdP (Keycloak) as the access token was fetched from above.
We are using this AppAuth library and it is following the best practices of RFC 8252 by using an external user agent so that the native application cannot snoop on the user credentials. Being iOS 13+, it is using ASWebAuthenticationSession. This part is working perfectly for us.

We are having problems when trying to then access our protected site via SFSafariViewController. The cookies set by the IdP from ASWebAuthenticationSession are not visible. This is the case no matter if the cookies are session or persistent cookies. As such, the user must authenticate again.

I'm highly confused about that state of cookie sharing of various types (persistent vs session) with the various versions of iOS and the various methods (ASWebAuthenticationSession, SFSafariViewController + WKWebView). There seems to be no definitive matrix that I've been able to find.

From spending time researching, it feels like with the present cookie restrictions on iOS (for security + privacy [good things!]), I can't accomplish what I want. This feels like such a common thing to want to do, I'm hoping I'm doing something wrong.

A couple of questions thus follow:

Can persistent and/or session cookie sharing across ASWebAuthenticationSession and SFSafariViewController be allowed in the same app?
If not, are there alternative approaches/patterns?
Thanks!

---

## Environment

iOS

Guide de contribution

Ouvrir le guide de contribution

Piste de recherche

Commencez par examiner le comportement de ASWebAuthenticationSession et SFSafariViewController décrit dans l’issue, en vous concentrant sur le partage des cookies entre les versions d’iOS et sur les types de cookies. Une résolution utile documenterait si les cookies de session ou persistants peuvent être partagés et identifierait les modèles alternatifs pris en charge.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Évaluation

Stack technique
ios
Domaine
authentication, mobile
Type d'issue
Bug
Difficulté
5/5
Temps estimé
Plus d'une semaine
Activité
À l'abandon
Clarté
À clarifier
Accessibilité débutants
20/100

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.