ThexXTURBOXx / flutter_web_auth_2

Flutter plugin for authenticating a user with a web service
https://pub.dev/packages/flutter_web_auth_2
MIT License
51 stars 50 forks source link

Option to Redirect to Custom URL After Auth Code Capture For Windows/Linux #74

Closed mostafaemara closed 11 months ago

mostafaemara commented 11 months ago

Is your feature request related to a problem? Please describe. After successful authentication, users see a page that says "you may now close this page." During this, users can observe the localhost URL and the auth code in the browser's address bar. This poses both a security risk and is not an ideal user experience.

Describe the solution you'd like I propose introducing an option to redirect the user to a custom URL after the auth code is captured. This way, developers can specify a custom, more user-friendly or informative URL for users to be directed to post-authentication, thereby hiding the localhost URL and the auth code from end-users.

Proposed API Changes Introduce an optional parameter, possibly named postAuthRedirectURL, when initiating the OAuth2 flow. If provided, after the auth code is captured, the package should perform an HTTP 302 redirect to the given URL.

FlutterWebAuth.authenticate(
    url: "<AUTH_URL>",
    callbackUrlScheme: "my-app",
    postAuthRedirectURL: "https://example.com/successful-login"
);

If the postAuthRedirectURL parameter isn't provided, the package should default to its current behavior.

Benefits

  1. Enhances security by hiding the auth code and localhost URL from users.
  2. Provides a better user experience by taking them to a meaningful or brand-consistent page post-authentication.
  3. Gives developers additional control over the authentication flow.

Describe alternatives you've considered An alternative could be to allow developers to customize the HTML content shown to users after auth code capture. This way, they can better integrate the messaging with their brand, but it still exposes the localhost URL.

Additional context Hiding sensitive information from users is critical, especially when dealing with authentication flows. This change would be a valuable enhancement.

ThexXTURBOXx commented 11 months ago

The option to change the displayed HTML code has already been added as part of the 3.0.0 update: https://pub.dev/packages/flutter_web_auth_2/versions/3.0.0-alpha.4