AppAuth browser sometimes is not getting the approval from Microsoft Authenticator when user goes back to the app that was in the background
Nobody has claimed this yet.
- Dominant language
- Objective-C
- Stars
- 2k
- Forks
- 867
- Avg merge
- 4d 48m
- Merged PRs (30d)
- 1
Description
Describe the bug
Our app has the following login flow:
- Call authState method so the login page is opened in a web view (will call it like this for simplicity).
- Enter user and password, then the page waits for approval from Microsoft Authenticator.
- The user opens Microsoft Authenticator, a dialog asking for approval appears, the user taps on "Approve".
- The user goes back to our app.
- When the user opens our app, the page in the browser should be updated automatically, then the page should ask the user whether he wants to stay signed in or not, whatever the user answer is, the web view is closed and the AppAuth callback is called with the access token, refresh token, etc.
The problem is that step 5 doesn't always work. Sometimes (it happens randomly), when the user goes back to our app after approving access from Authenticator, the page is not updated so the user gets stuck in the auth flow and have to try it again, after 2 to 4 attempts, the login works (sometimes it works on the first time).
It looks like the issue is related to the fact of our app being in the background when the user approves access in the Authenticator app, because if we follow the login flow, and approve access in the Microsoft Authenticator app in a different device, the login always works.
Is there any workaround to ensure the page always receives the approval from Authenticator despite our app being in the background?
Thanks in advance.
Expected behavior
The login flow should always work.
Environment
- Device: iPhone X but our users have reported this from different devices.
- OS: iOS 15, iOS 16
- Browser: The one opened by default by AppAuth.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the authState login flow and the AppAuth callback, reproducing the issue on iOS 15 and iOS 16 while the app is backgrounded during Microsoft Authenticator approval. Compare returning from Authenticator with approving on a different device; done means the browser page updates and the callback consistently receives the access and refresh tokens.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ios, objective-c
- Domain
- authentication, mobile
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100