MaikuB / MaikuB/flutter_appauth

iOS-FaceID Popup prevents In-App browser from opening

Open
#584 5 comments 2 reactions 0 assignees View on GitHub
Dominant language
Objective-C
Stars
308
Forks
301
Avg merge
2d 11h
Merged PRs (30d)
5

Description

Hello, we have come across a pretty rare bug, which I was able to reproduce in this repo: https://github.com/g-feil/flutterappauthbug

We are using flutter_appauth in combination with local_auth for biometric authentification. In a very specific case (which by design should not occur in our app, but it did), the FaceID Popup prevents the correct execution of `authorizeAndExchangeCode`. This is also shown in the attached video. We are using Ephemeral Session, the error occurs only on iOS.

https://github.com/user-attachments/assets/cf333056-2410-4547-855d-a15b2a6e63ec

Reproduction as provided in code:
1. Authenticate with biometrics using local_auth
2. Confirm Biometrics (FaceID in our case)
3. A small popup is seen for a few seconds, then the login page closes. (Tr: "App wants to use ... to sign in")

Why does this happen?
The callback of the local_auth `authenticate` gets called as soon as the user confirms. However iOS still plays an animation, that shows the confirmation (the face converts into a tick). The flutter code reaches `authorizeAndExchangeCode` while the animation is playing, and therefore this weird behavior occurs.

We were able to fix this issue by hardcoding a delay of 1.5 seconds, which is not optimal.
I don't think the local_auth package can fix this, because I have read in some forums, that this callback also gets executed early in native, but I'm not a pro in this area. The small popup in Step 3 leads me to think, that this case is interesting for the app_auth package.

Thanks for looking into this!

Contributor guide

Open the contributing guide

Research direction

Start with the linked flutterappauthbug reproduction and trace the iOS authorizeAndExchangeCode flow after local_auth's biometric callback. Reproduce the FaceID confirmation animation with an Ephemeral Session and inspect how the in-app browser is opened. Done means the login page opens correctly without relying on a hardcoded delay.

Written by the indexing model from the issue text.

Assessment

Tech stack
dart, ios, objective-c
Domain
authentication, mobile-dev
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.