openid / openid/AppAuth-iOS

Safari external browser is caching credentials data in recurrent login attempts. Only on iOS 14.5 and above.

Open
#638 6 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Objective-C
Stars
2k
Forks
867
Avg merge
4d 48m
Merged PRs (30d)
1

Description

When performing recurring OIDC login, the safari external browser is only showing up in a sec and dismisses it immediately. It looks like the safari browser is caching the credentials and it's using them in the recurrent login attempts.

To Reproduce
Steps to reproduce the behavior:

  1. Login with OIDC
  2. Kill the app
  3. Try to log in again
  4. External browser pops up and immediately hides.

Expected behavior
External browser should be shown and new credentials should be entered.

  • OS: iOS
  • Browser safari
  • Version 14.5, 14.6

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the recurring OIDC login flow on iOS 14.5 or 14.6: log in, kill the app, and log in again while observing the external-browser handoff. Inspect the external-browser authentication entry point; done means the browser remains visible and permits new credentials on the second login.

Written by the indexing model from the issue text.

Assessment

Tech stack
ios, objective-c
Domain
authentication, mobile
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.