search

ThexXTURBOXx / flutter_web_auth_2

Flutter plugin for authenticating a user with a web service
https://pub.dev/packages/flutter_web_auth_2
MIT License
53 stars 53 forks source link

Support In-App WebView #5

Open Joseph-Nathan opened 2 years ago

Joseph-Nathan commented 2 years ago

Describe the bug

Firebase BackEnd does n't support external callable method

To Reproduce

Steps to reproduce the behavior:

  1. Create FireBase project
  2. provide any Auth Provider as Google
  3. try to Authentication with external browser tab
  4. See Error : Unable to process request due to missing initial state. This may happen if browser sessionStorage is inaccessible or accidentally cleared.

Expected behavior

After Authentication , callable method fire and get back to App .

Screenshots

103522266-1f317180-4ea0-11eb-808f-50539f604b01

Device (please complete the following information!)

Additional context

if add support to in_App_Webview that will be great

AndreiRoze commented 2 years ago

Shortly, it's not library issue. Look like it's incorrect behaviour of Firebase for some phones/browsers. More info here https://github.com/firebase/firebase-js-sdk/issues/4256

Joseph-Nathan commented 2 years ago

@AndreiRoze we know , can you provide any way to pass this .

AndreiRoze commented 2 years ago

@Joseph-Nathan, you can try to use redirect to your server and from your server redirect to app by package name, but i am not sure, may be it useless.

ThexXTURBOXx commented 2 years ago

The issue may be related to Firebase, but the feature request with the In-App web view is a nice idea. So I let this open for now

komaxx commented 2 years ago

Wouldn't a In-App web view pretty much defeat the whole point of OAuth?

As far as I understand, running some sort of WebView in the caller's process also enables accessing everything that's entered into the login page (by adding JavaScript hooks, or DOM scraping, or piping interaction through an invisible overlay view, or ...), thus exposing user credentials to the calling app.

At that point there would be no security gain over just letting the user enter her credentials directly into the app, right?

ThexXTURBOXx commented 2 years ago

Yes, that is the reason why I recently decided against it. However, I am still thinking about other ways to provide the callback process

Joseph-Nathan commented 1 year ago

any news for provide callback process to Firebase ?