openid / openid/AppAuth-iOS

iOS 13 ASWebAuthenticationSession sign-in alert dismissed without error after app entered background

Open
#468 8 comments 5 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

platform-bug
Dominant language
Objective-C
Stars
2k
Forks
867
Avg merge
4d 48m
Merged PRs (30d)
1

Description

Describe the bug
On devices running iOS 13, whenever the browser (ASWebAuthenticationSession) is about to be displayed, the system fires the usual 'sign-in' alert. If another event pops to foreground (call, user locks the phone, etc...), upon returning the presentingViewController is correctly displayed but the alert is not visible anymore. In this scenario, the view is left idle waiting for the dialog to complete and the browser to be launched without any additional notification to the app.

To Reproduce
Steps to reproduce the behavior:

  1. Get to a UIViewController and initiate an auth process calling authStateByPresentingAuthorizationRequest:presentingViewController:callback:
  2. System 'sign-in' alert is displayed
  3. Lock the device
  4. Unlock it
  5. UIViewController is visible but the 'sign-in' alert is not

Expected behavior
Either the alert should show up when the app becomes active again (e.g. phone is unlocked), or the app should somehow be notified so that we can cancel the previous attempt and launch a new one.

Test device:

  • Device: iPhone SE
  • OS: iOS 13.2
  • Version: AppAuth-iOS tag 1.2.0

Additional context
Exploring app lifecycle callbacks the following behavior has been observed:

  • Whenever the alert is displayed applicationWillResignActive is called. Afterwards, when locking the phone, applicationDidEnterBackground is fired. Then, upon unlocking the device, applicationWillEnterForeground and applicationDidBecomeActive are called back to back.
  • In any regular UIViewController if the user locks the device, applicationWillResignActive and applicationDidEnterBackground are called back to back. If then unlocked, behavior remains same as before.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at authStateByPresentingAuthorizationRequest:presentingViewController:callback: and trace the ASWebAuthenticationSession flow alongside applicationWillResignActive, applicationDidEnterBackground, applicationWillEnterForeground, and applicationDidBecomeActive. Reproduce the lock-and-unlock sequence on iOS 13 and inspect the callback behavior. Done means the interrupted sign-in either reappears after activation or notifies the app so the attempt can be cancelled and retried.

Written by the indexing model from the issue text.

Assessment

Tech stack
objective-c
Domain
authentication, mobile-dev
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.