feat(supabase_flutter)!: use a system web auth session for OAuth, SSO and identity linking#1403
Draft
spydon wants to merge 1 commit into
Draft
feat(supabase_flutter)!: use a system web auth session for OAuth, SSO and identity linking#1403spydon wants to merge 1 commit into
spydon wants to merge 1 commit into
Conversation
… and identity linking Route signInWithOAuth, signInWithSSO and linkIdentity through flutter_web_auth_2 on native and desktop platforms, so the auth screen runs in ASWebAuthenticationSession on Apple platforms and Custom Tabs on Android. The session captures the redirect itself and closes automatically, fixing the blank in-app browser that was left open after a successful sign in (#1174). On web the current tab is redirected as before. url_launcher is dropped as a direct dependency and the LaunchMode export is removed. The authScreenLaunchMode/launchMode parameters are replaced by a preferEphemeral option that maps to the web auth session. BREAKING CHANGE: signInWithOAuth, signInWithSSO and linkIdentity no longer accept authScreenLaunchMode/launchMode, and the LaunchMode export is removed. Android apps must register the flutter_web_auth_2 CallbackActivity for their redirect scheme. The OAuth callback no longer arrives through the app_links deep link handler.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Move
signInWithOAuth,signInWithSSOandlinkIdentityoffurl_launcherand onto a native system web authentication session viaflutter_web_auth_2:ASWebAuthenticationSessionwebpackage)The session captures the redirect to the
redirectToscheme, closes itself, and returns the callback URL, which is exchanged withgetSessionFromUrl.Addresses #1402. Fixes #1174.
Why
url_launcher's in-app browser does not dismiss itself when the OAuth redirect returns to the app, leaving the user on a blank page after a successful sign in (#1174). A system web auth session is OS owned, auto-dismisses, and hands the callback back to the caller, so it fixes the dismissal on every platform and lets the call resolve on completion.Changes
flutter_web_auth_2; removeurl_launcheras a direct dependency and theLaunchModeexport.authScreenLaunchMode/launchModewith apreferEphemeraloption.redirectTo; forward host and path forhttpsuniversal links.package:web.oauth_test.dartcovering the native flow,preferEphemeral,httpsuniversal links, and the missing-redirectToerror.Breaking changes
authScreenLaunchMode/launchModeremoved;LaunchModeno longer exported.flutter_web_auth_2CallbackActivityfor their redirect scheme.app_linksdeep link handler (magic links, email confirmation and password recovery still do).Status
Draft.
flutter analyzeandflutter testpass, but the native and desktop flows have not been verified on device yet. See the open questions in #1402 (forcing the external browser, the web popup vs redirect choice, dropping the Google on Android workaround, desktop callback model).