feat: added support for webview as a provider for webauth #875

desusai7 · 2024-09-26T05:57:21Z

📋 feat: added support for webview as a provider for webauth

Added WKWebView as a User Agent for WebAuthentication along with ASWebAuthenticationSession & SFSafariViewController

Checklist

All new/changed/fixed functionality is covered by tests (or N/A)
[] I have added documentation for all new/changed functionality (or N/A)

🎯 Testing

Ensure that the WKWebView is working as a User Agent for performing the WebAuthentication

…tialsManagerSpec

Widcket · 2024-09-30T13:12:01Z

App/ViewController.swift

@@ -27,13 +27,15 @@ class ViewController: UIViewController {
    @IBAction func login(_ sender: Any) {
        Auth0
            .webAuth()
+            .useWebViewProvider()


I'd suggest adding a new static func to the WebAuthentication struct like https://github.com/auth0/Auth0.swift/blob/master/Auth0/SafariProvider.swift#L37, as that:

Follows the existing pattern in use for web providers

Avoids adding new useX() methods that have the disadvantage of being mutually exclusive (e.g. these can be chained and it's not clear which one will end up being used)

agreed, changed accordingly

Widcket · 2024-09-30T13:13:54Z

Auth0/Auth0WebAuth.swift

+    #if os(iOS)
+    private(set) var useWebViewProvider = false
+    private(set) var webViewProviderPresentationStyle: UIModalPresentationStyle = .fullScreen
+    #endif


Using a func like https://github.com/auth0/Auth0.swift/blob/master/Auth0/SafariProvider.swift#L37 also has the advantage of being on its own (gated) file, so there's no need to have these conditionals here.

changed accordingly

Widcket · 2024-09-30T13:17:26Z

Auth0/Auth0WebAuth.swift

-        let provider = self.provider ?? WebAuthentication.asProvider(redirectURL: redirectURL,
-                                                                     ephemeralSession: ephemeralSession)
+
+        #if os(iOS)


Same as above.

changed accordingly

Widcket · 2024-09-30T13:27:09Z

Auth0/WebAuthError.swift

+        case .webViewNavigationFailed: return "An error occured during a committed main frame navigation of WebView"
+        case .webViewProvisionalNavigationFailed: return "An error occured while starting to load data for the main frame of WebView"
+        case .webViewContentProcessTerminated: return "WebView's content process is terminated."
+        case .webViewResourceLoadingStopped: return "WebView's resource loading has been stopped"


Suggested change

case .webViewNavigationFailed: return "An error occured during a committed main frame navigation of WebView"

case .webViewProvisionalNavigationFailed: return "An error occured while starting to load data for the main frame of WebView"

case .webViewContentProcessTerminated: return "WebView's content process is terminated."

case .webViewResourceLoadingStopped: return "WebView's resource loading has been stopped"

case .webViewNavigationFailed: return "An error occurred during a committed main frame navigation of the WebView."

case .webViewProvisionalNavigationFailed: return "An error occurred while starting to load data for the main frame of the WebView."

case .webViewContentProcessTerminated: return "The WebView's content process was terminated."

case .webViewResourceLoadingStopped: return "The WebView's resource loading was stopped."

updated accordingly

Widcket · 2024-09-30T14:07:22Z

Auth0/WebViewProvider.swift

+}
+
+extension WebViewUserAgent {
+    var topViewController: UIViewController? {


We already have this logic here: https://github.com/auth0/Auth0.swift/blob/master/Auth0/SafariProvider.swift#L50-L77
Maybe we can put it in some kind of shared helper (e.g. an internal static var added to UIWindow –analogous to rootViewController)?

agreed, moved this to a shared helper

Widcket · 2024-09-30T14:16:11Z

Auth0/WebViewProvider.swift

+
+    static let customSchemeRedirectionSuccessMessage = "com.auth0.webview.redirection_success"
+    static let customSchemeRedirectionFailureMessage = "com.auth0.webview.redirection_failure"
+    let defaultSchemesSupportedByWKWebview = ["http", "https"]


I'd suggest checking with somebody from the security team if we should be supporting http schemes here (vs https only), e.g. when using an authorize URL override that proxies to Auth0.

Widcket · 2024-09-30T15:39:32Z

Auth0/WebViewProvider.swift

+            NSLocalizedDescriptionKey: "WebViewProvider: WKURLSchemeHandler: Webview Resource Loading has been stopped"
+        ])
+        urlSchemeTask.didFailWithError(error)
+        self.finish(with: .failure(WebAuthError(code: .webViewResourceLoadingStopped)))


Should this error case be userCancelled?

yes, updated accordingly

Co-authored-by: Rita Zerrizuela <[email protected]>

fal3 · 2024-10-01T14:47:14Z

I've tested this on my local branch and it still does not fix my webview issue.

desusai7 · 2024-10-03T05:57:58Z

I've tested this on my local branch and it still does not fix my webview issue.

Hi @fal3,

Can you please share more details about the webview issue you are running into ?

fal3 · 2024-10-03T15:28:44Z

I've tested this on my local branch and it still does not fix my webview issue.

Hi @fal3,

Can you please share more details about the webview issue you are running into ?

We get this simulator crash 👇 . Which is also related to this incident

log.txt

desusai7 · 2024-10-04T05:39:09Z

I've tested this on my local branch and it still does not fix my webview issue.

Hi @fal3,
Can you please share more details about the webview issue you are running into ?

We get this simulator crash 👇 . Which is also related to this incident

log.txt

@fal3, I would like to clarify that this pull request is not intended to address the issue you mentioned. Additionally, regarding the crash you are experiencing, could you please confirm if you were able to reproduce this issue on a real device as well?

furrki · 2024-10-07T12:51:14Z

I've tested this on my local branch and it still does not fix my webview issue.

Hi @fal3,
Can you please share more details about the webview issue you are running into ?

We get this simulator crash 👇 . Which is also related to this incident
log.txt

@fal3, I would like to clarify that this pull request is not intended to address the issue you mentioned. Additionally, regarding the crash you are experiencing, could you please confirm if you were able to reproduce this issue on a real device as well?

I can confirm that this issue happens only on simulator.

Auth0Tests/WebViewProviderSpec.swift

Widcket · 2024-10-08T22:43:14Z

Auth0Tests/WebViewProviderSpec.swift

+        }
+
+        describe("initialization") {
+            it("should initialize with correct parameters") {


Should we add a test case that uses returnTo instead of redirect_uri?

yes, added it now

Co-authored-by: Rita Zerrizuela <[email protected]>

…in case of webviewprovider

Auth0/WebViewProvider.swift

Co-authored-by: Rita Zerrizuela <[email protected]>

feat: added support for webview as a provider for webauth

21a691d

desusai7 self-assigned this Sep 26, 2024

desusai7 requested a review from a team as a code owner September 26, 2024 05:57

desusai7 added 3 commits September 27, 2024 14:36

test: minor changes to Matchers definitions

017e31b

chore: minor changes to the sample app

843703b

test: minor changes to the timeouts in WebViewProviderSpec and Creden…

351ffaf

…tialsManagerSpec

Widcket reviewed Sep 30, 2024

View reviewed changes

desusai7 and others added 2 commits October 1, 2024 11:35

chore: updated description of WebAuthError codes

a519581

Co-authored-by: Rita Zerrizuela <[email protected]>

chore: moved the logic to get the top view controller to a single place

902e181

chore: used provider pattern for webview user agent as well

add7f43

chore: minor changes

405d22b

desusai7 force-pushed the feat/webview_support branch from 9e5fe87 to 405d22b Compare October 3, 2024 06:09

desusai7 added 2 commits October 3, 2024 11:45

chore: minor changes

e2f23cb

chore: improved the error messages of webauth error

e7fc8ff

desusai7 requested a review from Widcket October 4, 2024 05:39

desusai7 added 2 commits October 7, 2024 16:41

chore: added webview related files to as part of webauth flow

77840f7

chore: minor fixes for the custom scheme handling in webview provider

73160d2

Widcket reviewed Oct 8, 2024

View reviewed changes

Auth0Tests/WebViewProviderSpec.swift Outdated Show resolved Hide resolved

Widcket reviewed Oct 8, 2024

View reviewed changes

desusai7 and others added 3 commits October 9, 2024 12:47

chore: update Auth0Tests/WebViewProviderSpec.swift

7e6135d

Co-authored-by: Rita Zerrizuela <[email protected]>

test: added unit tests for capturing redirect url from authorize url …

bddf7a5

…in case of webviewprovider

test: minor updates to unit tests for webview provider

b8de698

desusai7 requested a review from Widcket October 9, 2024 12:29

Widcket previously approved these changes Oct 9, 2024

View reviewed changes

chore: added warning against the usage of WKWebView for WebAuth

eeb0e40

desusai7 dismissed Widcket’s stale review via eeb0e40 October 10, 2024 04:31

desusai7 requested a review from Widcket October 10, 2024 04:32

Widcket reviewed Oct 10, 2024

View reviewed changes

Auth0/WebViewProvider.swift Outdated Show resolved Hide resolved

chore: update Auth0/WebViewProvider.swift

aa8441f

Co-authored-by: Rita Zerrizuela <[email protected]>

desusai7 requested a review from Widcket October 14, 2024 04:38

Widcket approved these changes Oct 14, 2024

View reviewed changes

desusai7 merged commit 2edbb4f into master Oct 14, 2024
15 checks passed

desusai7 deleted the feat/webview_support branch October 14, 2024 08:48

desusai7 mentioned this pull request Oct 14, 2024

Release 2.10.0 #878

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: added support for webview as a provider for webauth #875

feat: added support for webview as a provider for webauth #875

desusai7 commented Sep 26, 2024

Widcket Sep 30, 2024

desusai7 Oct 3, 2024

Widcket Sep 30, 2024

desusai7 Oct 3, 2024

Widcket Sep 30, 2024

desusai7 Oct 3, 2024

Widcket Sep 30, 2024

desusai7 Oct 3, 2024

Widcket Sep 30, 2024

desusai7 Oct 3, 2024

Widcket Sep 30, 2024

Widcket Sep 30, 2024

desusai7 Oct 3, 2024

fal3 commented Oct 1, 2024

desusai7 commented Oct 3, 2024

fal3 commented Oct 3, 2024

desusai7 commented Oct 4, 2024

furrki commented Oct 7, 2024

Widcket Oct 8, 2024

desusai7 Oct 9, 2024

feat: added support for webview as a provider for webauth #875

feat: added support for webview as a provider for webauth #875

Conversation

desusai7 commented Sep 26, 2024