4 ms·
This is why the OAuth Identity Providers that take security most seriously do not allow WebView login (or at least provide an SDK where you don't need it).
by habosa 10y ago
This is why the OAuth Identity Providers that take security most seriously do not allow WebView login (or at least provide an SDK where you don't need it).
- EGreg 10y agoHow exactly do you prevent a user agent WebView in an app from spoofing iOS Safari?
- habosa 10y agoIt's very hard to do but you can at least make your SDK do a fast app switch to safar rather than use a WebView. Of course evil apps can find a way around it like you said but at least you can make your SDK and Documentation point the right way, I am not experienced with iOS but I also suspect there are more advanced WebView detection tricks. It also doesn't help that Apple really doesn't like fast app switching.
- blazespin 10y agoyou email the authn link to the user rather than use openurl