MaikuB / MaikuB/flutter_appauth
iOS-FaceID Popup prevents In-App browser from opening
- Dominant language
- Objective-C
- Stars
- 308
- Forks
- 301
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 5
Description
Hello, we have come across a pretty rare bug, which I was able to reproduce in this repo: https://github.com/g-feil/flutterappauthbug
We are using flutter_appauth in combination with local_auth for biometric authentification. In a very specific case (which by design should not occur in our app, but it did), the FaceID Popup prevents the correct execution of `authorizeAndExchangeCode`. This is also shown in the attached video. We are using Ephemeral Session, the error occurs only on iOS.
https://github.com/user-attachments/assets/cf333056-2410-4547-855d-a15b2a6e63ec
Reproduction as provided in code:
1. Authenticate with biometrics using local_auth
2. Confirm Biometrics (FaceID in our case)
3. A small popup is seen for a few seconds, then the login page closes. (Tr: "App wants to use ... to sign in")
Why does this happen?
The callback of the local_auth `authenticate` gets called as soon as the user confirms. However iOS still plays an animation, that shows the confirmation (the face converts into a tick). The flutter code reaches `authorizeAndExchangeCode` while the animation is playing, and therefore this weird behavior occurs.
We were able to fix this issue by hardcoding a delay of 1.5 seconds, which is not optimal.
I don't think the local_auth package can fix this, because I have read in some forums, that this callback also gets executed early in native, but I'm not a pro in this area. The small popup in Step 3 leads me to think, that this case is interesting for the app_auth package.
Thanks for looking into this!
Contributor guide
Research direction
Start with the linked flutterappauthbug reproduction and trace the iOS authorizeAndExchangeCode flow after local_auth's biometric callback. Reproduce the FaceID confirmation animation with an Ephemeral Session and inspect how the in-app browser is opened. Done means the login page opens correctly without relying on a hardcoded delay.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- dart, ios, objective-c
- Domain
- authentication, mobile-dev
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100