Open nikthakkar opened 7 years ago
To do this the server side code is already implemented. See this part of the code for the auth redirect: https://github.com/firebase/custom-auth-samples/blob/master/instagram/app.js#L119-L126
And this for the code exchange https://github.com/firebase/custom-auth-samples/blob/master/instagram/app.js#L133-L148
Basically the Android/iOS native app has to follow this flow:
/instagram-mobile-redirect?state=<nonce>
URL of the server (use the nonce generated in step 1) in a Chrome Custom tab (or equivalent in iOS).instagram-sign-in-demo://instagram-mobile-callback?code=<code>&state=<nonce>
the app needs to intercept this URI (i.e. in android add an intent filters for incoming links with custom scheme URI) and read the code
and state
URL parameter values.
PS: you should change the custom scheme on this line to have your own.
state
parameter equals the one saved in memory at step 1 to avoid session fixation attacks./instagram-mobile-exchange-code?code=<code>
, this will return the Firebase custom auth token that you can use to sign in your user to Firebase.@bojeil-google in case he has anything else to add or other techniques he wants to discuss.
Seems reasonable. A few recommendations:
On Android, consider using FDL (Firebase Dynamic Links) links to redirect back to the app for additional security. As custom schemes in android are less secure since they don't have the controlled and regulated ecosystem that Apple has and any app can claim a custom scheme.
It would be great if we can have a example build for an Android app so that the best practices are followed in implementing other OAuth providers. Thanks.