Feature Request: Add the ability to open Auth0 login in an embedded WebView about auth0-oidc-client-net HOT 3 CLOSED

Thanks for the request,

We have no intention to support Embedded WebView, one of the reasons is that Google has blocked OAuth flows from Embedded WebViews since 2017, see https://auth0.com/blog/google-blocks-oauth-requests-from-embedded-browsers/ for more information around this.

Even though this is not Xamarin, but the native WebView documentation also recommends using browsers such as Chrome: https://developer.android.com/reference/android/webkit/WebView

Our general recommendation is to use a trusted browser to ensure users are aware they are entering their credentials in a known and secure browser.

That said, what browser are you using for Auth0Client? Or are you relying on the default one?
We have two browsers available:

• https://github.com/auth0/auth0-oidc-client-net/blob/master/src/Auth0.OidcClient.Android/ChromeCustomTabsBrowser.cs
• https://github.com/auth0/auth0-oidc-client-net/blob/master/src/Auth0.OidcClient.Android/SystemBrowser.cs

ChromeCustomTabsBrowser should be used by default and results in the behavior visible in the GIF here: https://developer.chrome.com/multidevice/android/customtabs

Is this the one you are using? If so, what exactly do you not like about that?

from auth0-oidc-client-net.

Thanks for reopening and inquiring. I might have been a bit too narrow with the original problem description. As far as I know, the main problem was not just Android, but especially die dialogue on iOS that asks the user every time if it is allowed to login using an external provider. Is there any way we can circumvent that and give a more seamless experience?

I will also ask my colleague again for more details and then come back to you with more info.

from auth0-oidc-client-net.

There is more information around this here: https://community.auth0.com/t/ios-swift-remove-consent-dialog-social-login-with-auth0/9006/5

But in short, this is a decision from Apple to protect their users in case you want to authenticate using an external provider.

There is however a way to not show this popup, which is by using Ephemeral Sessions (there is a feature request for it here: #157).

Keep in kind that, even tho this removes the popup, it has other consequences for the user:

• No cookie is saved
• User has to re-login every time they click login
• Acts as if you are using an incognito browser

So if that popup is what you want to avoid, the only solution is to wait for #157 to be implemented. I will be closing this issue as a duplicate, but feel free to reopen if needed.

from auth0-oidc-client-net.