MaikuB / flutter_appauth

A Flutter wrapper for AppAuth iOS and Android SDKs
273 stars 246 forks source link

Ability to disable persist cookies on Android #387

Closed sylvestrevgenhiveon closed 1 year ago

sylvestrevgenhiveon commented 1 year ago

I need to login to multiple accounts. On iOS, using ephemeral session, I can do this, cause cookies are not persist and all is isolated. But I can't do this on Android, cause cookies from first login are persist and when I want to login to another account my auth service says that I already login by first account in this session. How can I turn off persist cookies on Android?

sylvestrevgenhiveon commented 1 year ago

@MaikuB

Dahkenangnon commented 1 year ago

@sylvestrevgenhiveon

My first question is, does your IdP support multiple account like the known multiple account of Google ?

I think this is not in fact the case. So, for me, I recommend to look over their first because, as I know the Open Id Connect or OAuth standards don't tell anything about this features (the multiple account, and account switching). So the implementation that is the responsibility of your IdP.

Maybe I don't realy understand your issue. More details in this case please

Thank

sylvestrevgenhiveon commented 1 year ago

@Dahkenangnon IdP not support multiple account in one session. It looks on cookies. On iOS cookies are not persist for every web view call, so when I open WebView login again, prev cookies don't save, so I can login in other account and save all necessary tokens for my app and handle it separately. But on Android I can't do this, because when I open WebView again after first success login, cookies are saved and IdP says that I can't login in other account while in this session I logged in. But. Cookies have an expiration time. So when I hold around 10 minutes and try to login to another account again - I can login. So, I need to have ability to reset cookies every time when I open login WebView.

pietzschke commented 1 year ago

+1

MaikuB commented 1 year ago

This plugin is a wrapper for native SDKs as has been stated as such in the docs with links to https://appauth.io that in turn has links to the SDKs for each platform. This means if you want to know if there's an ability to do something then you need first see if these SDKs even support it and is something you'll need to do more research on for your needs. This also means that what the plugin can or can't do is constrained by what those SDKs so.

MaikuB commented 1 year ago

Closing as this is something OP will need to do further research on. One thing other thing to bear in mind is in iOS, Apple have their own browser so they have more control on having private sessions. Android is more open ended even though there's Chrome. I would suspect it's not possible but this is something you would need to do research on