UIA fallback completion mechanism does not work well on mobile devices

https://matrix.org/docs/spec/client_server/r0.6.1#fallback describes a mechanism by which an application can be notified when a user-interactive auth step completes:

This allows the client to either arrange for the global function onAuthDone to be defined in an embedded browser, or to use the HTML5 cross-document messaging API, to receive a notification that the authentication stage has been completed.

However, modern best-practice discourages the use of embedded browsers (ie, webviews) and indeed some identity providers refuse any requests made from such browsers. For example Google says:

This user-agent is not permitted to make an OAuth authorization request to Google as it is classified as an embedded user-agent (also known as a web-view). Per our policy, only browsers are permitted to make authorization requests to Google.

This means that mobile apps have to use a regular browser to complete the auth step, so have no way of knowing when the step completes, and the user ends up stuck in a "you can go back your app now" page.

Note that "UIA fallback" is used for all user-interactive authentication via SSO providers, which is to say that anybody who logged in via SSO and performs an action which requires their identity to be reconfirmed will hit this problem.

Start by reading the UIA fallback section in the linked Matrix client-server specification and the described embedded-browser and cross-document messaging behavior. Compare it with the mobile browser and SSO constraints described here. Done would require an agreed mechanism that lets mobile clients detect completion without relying on embedded browsers.