Should the use of explicit app schemes be discouraged as redirectUrls?
- Dominant language
- HTML
- Stars
- 57
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Description
So with the launch of Indigenous I have noticed several issues with app schemes (example: Indigenous://callback/path).
First, I have found many new IndieAuth implementations due to time/complexity and potentially not understanding why it's important, have not implemented Client Information Discovery (4.2). WordPress IndieAuth just added a warning of the mis-match between the app scheme and the client_id, which seemed okay. However, there was some more insidious issue that is still not understood as a variety of people who had all sort of different authentication issues with Wordpress were all fixed when I changed my app scheme to be based off of my client_id with a 302 redirect url (One such example: https://github.com/indieweb/wordpress-indieauth/issues/70).
Another example of an IndieAuth issue is Micro.blog's implementation which currently, just stops processing if the redirectUrl is not underneath the client_id. Instead of the warning that WordPress provides, Micro.blog just rejects the authentication. In the next update (no timeline given), from what I understand, Micro.blog does plan to change over to the WordPress way of authenticating with a warning.
However, the seeming lack of awareness and numerous issues makes me wonder if one of two things needs to happen.
1. We recommend using 302 redirects to app schemes from urls underneath the client_id
All of my issues seems to be fixed by changing my redirectUrl from `indigenous://callback/path` to `https://indigenous.abode.pub/ios/redirect-path`. Where `https://indigenous.abode.pub/ios/redirect-path` is just a 302 redirect to `indigenous://callback/path`.
2. We develop some sort of testing suite for app schemes so that people can test their IndieAuth implementations against app schemes to ensure it works correctly.
Contributor guide
No contributing guide indexed for this repository
Research direction
No file, test, or entry point is identified. The issue presents two possible directions—documenting a recommendation for app-scheme redirect URLs or developing a testing suite—so a contributor would first need a maintainer decision before defining what done means.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- html, wordpress
- Domain
- authentication
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100