capacitor-community / generic-oauth2

Generic Capacitor OAuth 2 client plugin. Stop the war in Ukraine!
MIT License
231 stars 113 forks source link

URL Scheme Security #173

Open phal0r opened 3 years ago

phal0r commented 3 years ago

Description

This is a general question regarding the security of url schemes. Since every app can register url schemes without validation, I think, that this is a general security issue. Why is it not best practice to use App Links / Universal Links for linking back to the app. Can they not be opened from within InApp Browser or is there another reason? Or is it possible to restrict url schemes linking when using InApp Browser to the own app?

Happy to hear your thoughts regarding this topic.

Capacitor version:

latest

Replace this with the commands output

Library version:

OAuth Provider:

Your Plugin Configuration