It doesn't redirect back to the app after successful login

[808thlife]

I'm using flutter_appauth library for implementing oauth2 with custom web service.

Problem: When the user signs in, in a clear browser without cache, cookies etc. (meaning that there are no active session in it), it doesn't redirect the user to the app. However, when the browser already has an active session (user can obtain it if he provides correct credentials and then exits the browser) redirection works perfectly fine.

So basically this is the flow for better understanding:

1. User enters the app
2. Clicks on sign in button
3. Provides correct credentials (browser doesn't redirect)
4. Exits the browser
5. Clicks sign in button again
6. This time redirection works without asking for credentials (because the browser already has active session in it)

This is the code

Login

final AuthorizationTokenResponse result =
          await appAuth.authorizeAndExchangeCode(
        AuthorizationTokenRequest(
          Constants.oauth2ClientId,
          'com.myapp.app://oauthredirect',
          serviceConfiguration: AuthorizationServiceConfiguration(
            authorizationEndpoint: API.oauth2authorize().toString(),
            tokenEndpoint: API.oauth2token().toString(),
          ),
          preferEphemeralSession: true,
          scopes: [
            'read',
            'write',
          ],
          allowInsecureConnections: true,
        ),
      );

build.gradle

manifestPlaceholders += [appAuthRedirectScheme: 'com.myapp.app']

I've already checked if redirect schemes are similar with the backend and everything is fine.

[anderscheow]

@808thlife What have you done to solve this issue? I'm facing similar issue

[808thlife]

@anderscheow I just separated authorization and token exchange logic. Make sure you are calling token api endpoint after authorization phase.

This is how i implemented it (it's not the full code)

final AuthorizationResponse authResponse = await appAuth.authorize(
        AuthorizationRequest(
          "ad6jnO5ZuqIbrSQEtF05xA67Fc0JW7JJ6vQNYzuW",
          "com.app.app://oauthredirect",
          discoveryUrl: API.oauth2DiscoveryUrl().toString(),
          promptValues: ["login"],
          scopes: ['openid'],
          nonce: "ad6jnO5ZuqIbrSQEtF05xA67Fc0JW7JJ6vQNYzuW",
          allowInsecureConnections: true,
        ),
      );

      log("Authorization: ${authResponse.toString()}");

      if (authResponse.authorizationCode != null) {

        final TokenResponse result = await appAuth.token(
          TokenRequest(
            "ad6jnO5ZuqIbrSQEtF05xA67Fc0JW7JJ6vQNYzuW",
            "com.app.app://oauthredirect",
            authorizationCode: authResponse.authorizationCode,
            codeVerifier: authResponse.codeVerifier,
            grantType: "authorization_code",
            scopes: ['openid'],
            nonce: "ad6jnO5ZuqIbrSQEtF05xA67Fc0JW7JJ6vQNYzuW",
            discoveryUrl: API.oauth2DiscoveryUrl().toString(),
            allowInsecureConnections: true,
          ),
        );