capacitor-community / capacitor-community/generic-oauth2

I am not able to hide URL bar

Open
#239 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
281
Forks
129
PR merge metrics
No merged PRs in 30d

Description

### Capacitor version:

Run `npx cap doctor`:

```
Latest Dependencies:

@capacitor/cli: 5.4.1
@capacitor/core: 5.4.1
@capacitor/android: 5.4.1
@capacitor/ios: 5.4.1

Installed Dependencies:

@capacitor/cli: 4.3.0
@capacitor/core: 4.3.0
@capacitor/android: 4.3.0
@capacitor/ios: 4.3.0

[success] iOS looking great! 👌
```

### Library version:

- 3.0.1

### OAuth Provider:

- Azure AD (B2C)

### Your Plugin Configuration

```typescript
{
export const oAuthConfig = {
oauth2Options: {
appId: environment.clientId,
authorizationBaseUrl: `${environment.authority}/oauth2/v2.0/authorize?prompt=login`,
scope: 'user.read openid profile offline_access',
accessTokenEndpoint: `${environment.authority}/oauth2/v2.0/token`,
resourceUrl: 'https://graph.microsoft.com/v1.0/me/',
responseType: 'code',
pkceEnabled: true,
logsEnabled: true,
web: {
redirectUrl: environment.redirectUriWeb,
windowOptions: 'height=600,left=0,top=0'
},
android: {
redirectUrl: environment.redirectUri,
additionalParameters: {
location: 'yes',
clearcache: 'yes',
clearsessioncache: 'yes',
hidenavigationbuttons: 'yes',
hideurlbar: 'yes',
fullscreen: 'yes',
zoom: 'no'
}
},
ios: {
pkceEnabled: true,
redirectUrl: environment.redirectUri
}
},
oauth2RefreshOptions: {
appId: environment.clientId,
accessTokenEndpoint: `${environment.authority}/oauth2/v2.0/token`,
refreshToken: '',
scope: 'user.read openid profile offline_access'
},
logoutBaseUrl: `${environment.authority}/oauth2/v2.0/logout?post_logout_redirect_uri=${environment.postLogoutRedirectUri}&client_id=${environment.clientId}`
};
}
```

### Affected Platform(s):

* Android
* Version/API Level: 13
* Device Model: Google Pixel 6a
* Content of your `AndroidManifest.xml`
```xml























```
### Current Behavior

Once azure login opens in browser, it shows URL bar with share button which user can share through any other app.

### Expected Behavior

URL bar with share button should be hidden for security purpose while running in native device.
![Screenshot_20231003-201747](https://github.com/moberwasserlechner/capacitor-oauth2/assets/146854493/abff8137-af87-4458-94b4-9014793ba95f)

### Sample Code or Sample Application Repo

### Reproduction Steps

### Other Information

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the Azure AD login on Android 13 using the shown OAuth configuration, especially the android additionalParameters including hideurlbar, and compare it with the supplied AndroidManifest.xml. Trace the Android login entry point that opens the browser and verify whether the URL bar and share button remain visible. Done means the native login flow hides them without breaking authentication or redirect handling.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, typescript
Domain
authentication, mobile
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.