openid / openid/AppAuth-iOS

`OIDExternalUserAgentSession` flow cannot be resumed from URL after app termination

Open
#819 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

help wanted
Dominant language
Objective-C
Stars
2k
Forks
867
Avg merge
4d 48m
Merged PRs (30d)
1

Description

Describe the bug

I am trying to handle the case where the app has been terminated when an auth flow is in progress. For context, this is using an email magic link flow, so there may be some time between the flow being initiated on the app side, and the link being followed in a user's email client.

What is the best way to handle the scenario where the user taps the one-time link in their email client, but the app is no longer running, and hence there is no current OIDExternalUserAgentSession to use to resume the auth flow from?

Normally you would do something like currentFlow.resumeExternalUserAgentFlow(with: url), but in this case the current flow no longer exists.

This scenario does not appear to be in any of the examples, or documented anywhere I could find.

Is the correct approach to persist the original OIDAuthorizationRequest when the flow is initiated and recreate the flow using:

OIDAuthState.authState(
    byPresenting authorizationRequest: OIDAuthorizationRequest,
    presenting presentingViewController: UIViewController
    callback: @escaping OIDAuthStateAuthorizationCallback
) -> OIDExternalUserAgentSession

Is this even a valid use case? Is the one-time code in the email expected to be immediate use, and so any app termination in the meantime means you have to request another link to authenticate?

Any guidance greatly appreciated.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Begin with the OIDExternalUserAgentSession resumeExternalUserAgentFlow(with:) path and the OIDAuthState.authState(...) entry point; compare them with the existing examples and documentation. Define whether terminated-app recovery is supported and, if so, document or test the expected restoration flow; otherwise document the limitation and required user action.

Written by the indexing model from the issue text.

Assessment

Tech stack
objective-c
Domain
authentication, mobile
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.