You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Using SFSafariViewController to login and assuming I've setup Universal Link support for my iOS app on my domain, how do I leverage and redirect to my domain using universal login from within SFSafariViewController?
Is anyone using universal links in production for native apps, I haven't been able to find any examples and I'm struggling a lot with it myself. It works fine the first time (when I don't currently have an auth session and I'm not logged in on the provider) probably because the redirect then happens after a button click and not due to automatic redirection.
I open the app and it creates an OIDAuthorizationRequest
I haven't authorised the app before, so after logging in at the OAuth Provider I see the "consent screen" where I can tap "authorize". The page is then redirected to the redirect URL, and the embedded browser/auth-view is automatically dismissed and I get the access/refresh tokens.
The next time I try to create an OIDAuthorizationRequest I have already authorised the app and I am already logged in at the OAuth Provider, so it automatically redirects be to the redirect URL. When this happens I just see the page for the redirect URL in the embedded browser/auth-view. This is because the OS never forwards the request to the app, thus application(_ application: UIApplication, continue userActivity: NSUserActivity, restorationHandler: @escaping ([UIUserActivityRestoring]?) -> Void
is never called.
(Btw, the README and the examples doesn't support Universal Links, because they rely on AppDelegate's application(_ app: UIApplication, open url: URL, options: [UIApplicationOpenURLOptionsKey : Any] = [:]) -> Bool instead of the continue userActivity as mentioned above).
@grEvenX, as you are aware, this is not really an AppAuth-iOS specific issue. My (non-production) experience, which I described in #396, was that the authorization endpoint needs to be visited from an intermediate screen in order for Universal Links to be redirected to the app. In the case of the in-app browser tabs, the user needs to navigate to the authorization endpoint. With Safari, it appears, navigation/redirection to the authorization endpoint may occur automatically. Like I said in the other issue, I am not entirely sure why this has to apply to the authentication classes, which AppAuth uses in iOS 11 and 12. Looks like something overlooked by Apple and to be fixed by them.
In my case, I don't even get a callback. None of the options open url or user activity. When I dump the request URL and paste it into the notes app and click the link there, everything works just fine. Any idea, what could have gone wrong?
I have the same issue as above. Universal link works fine from Notes, but is not triggered on a redirect from the identity provider. During the flow there is user interaction. Is there any response to this?
Has anyone found an issue to this? On My app, a blank page opens on SFSafariViewController which says 0kb. but it doesn't redirects to the app. But the universal links are correctly implemented as I have checked by using the redirect url in the notes.
Same here. I have implemented applinks with wildcard, but didn't get callback even for custom scheme. In case if wildcard not exist in entitlements, everything works as expected.
I'm having the same issue as everyone above. Has anyone been able to solve this? @PankovSerge Do universal link OAuth work from you if opened from a SFSafariViewController or ASWebAuthenticationSession within the app? iOS 15.2
Joren-Thijs-KasparSolutions commented on Jun 12, 2023
I am suffering the same issue today. The in-app browser opens. goes to IDP login screen. I login, and then i'm sent to a blank page (since my redirect uri points to a non existingwebpage) and get stuck there instead of closing the browser and returning to the app. Has anyone been able to get this working with universal links yet?
@Joren-Thijs-KasparSolutions Did you use ASWebAuthenticationSession? I've suffered the same issue for 3 days, and finally find out universal link is not supported as redirect URL when using ASWebAuthenticationSession.
So the workaround could be:
Using a custom scheme URL as the redirect URL
Using a non-universal link(of your app) and implement redirecting to a deeplink of your app in this webpage(opened through your non-universal link)
@XiangloongChen I ended up with custom schema, since it is safe to use custom schema with ASWebAuthenticationSession, which was made by Apple specifically for authentication purpose. The session information is not shared with Safari or any other apps, so the custom schema would only redirect within the specific app, even if any malicious app registers for it. The official documentation says:
ASWebAuthenticationSession ensures that only the calling app’s session receives the authentication callback, even when more than one app registers the same callback URL scheme.
Reacted by Chen Xianglong, Lode Vanhove, Balazs Czirjak and Marc Boudou
Joren-Thijs-KasparSolutions commented on Jun 19, 2024
We've been running into the same issue for years now, and decided to stick around with custom schemes. (Given that another app cannot hijack a session initiated by our app). We did file a RADAR a couple of years ago with Apple, since we are not getting the callback once the universal link is loaded in some scenarios such as autofilled passwords from keychain. Yet to get a proper response from them.
I am facing the same issue.
To investigate whether the problem lies with AppAuth or ASWebAuthenticationSession, I wrote some simple code. I obtained the request URL from OIDAuthorizationRequest and set it as the URL for ASWebAuthenticationSession. I then compared two scenarios: setting the callbackURLScheme to the scheme of the redirect URL (in this case, https) similar to how it's done in AppAuth, and using the callback: ASWebAuthenticationSession.Callback with the universal link's host and path, which is available from iOS 17.4 onwards.
The results of the tests showed that using the current callbackURLScheme specification for ASWebAuthenticationSession did not trigger the completionHandler and did not work. However, when using the callback: ASWebAuthenticationSession.Callback specification available from iOS 17.4 onwards, the completionHandler was called, and it functioned correctly.
From these findings, I understand that AppAuth, which relies on ASWebAuthenticationSession, only works with custom URL schemes.
I verified with the following code.
let authRequest = OIDAuthorizationRequest(...)
let session = ASWebAuthenticationSession(
url: authRequest.authorizationRequestURL(),
callback: ASWebAuthenticationSession.Callback.https(
host: <host>,
path: <path>
)
) { url, error in
// working
}
session.presentationContextProvider = contextProvider
session.start()
let authRequest = OIDAuthorizationRequest(...)
let session = ASWebAuthenticationSession(
url: authRequest.authorizationRequestURL(),
callbackURLScheme: "https"
) { url, error in
// not working
}
session.presentationContextProvider = contextProvider
session.start()
Reacted by treastrain / Tanaka Ryoga, Dosukoi, Marc Boudou, HPanda, Andreas Garvik, ierae-nagoya and Victor
For complicated reasons I have to use https schemes than custom URL schemes, and I also couldn't get redirect to work with AppAuth's ASWebAuthenticationSession. But a workaround that did work for me was using the custom Safari browser:
Hi all! Thanks to the generous help of a contributor, we've merged #978. Once the next release lands, you'll be able to use HTTPS links. Please note that this is not the same thing as a "universal link". It's ~functionally the same setup, but requires you to use webcredentials in addition to applinks in your registration file (see the Apple docs).
Activity
WilliamDenniss commentedon Mar 21, 2019
You need to call
[_currentAuthorizationFlow resumeExternalUserAgentFlowWithURL:url]from the method in your delegate that receives the universal link.E.g. like this, but in the universal link method:
AppAuth-iOS/Examples/Example-iOS_ObjC/Source/AppDelegate.m
Lines 50 to 55 in 0c82267
galsc-tr commentedon Mar 24, 2019
How do I redirect from inside the HTML's WebView? (asking for both Android & iOS).
grEvenX commentedon Mar 25, 2019
Is anyone using universal links in production for native apps, I haven't been able to find any examples and I'm struggling a lot with it myself. It works fine the first time (when I don't currently have an auth session and I'm not logged in on the provider) probably because the redirect then happens after a button click and not due to automatic redirection.
See other user with the same problem here:
https://stackoverflow.com/questions/45239215/universal-link-fails-when-oauth2-login-page-redirects-immediately
To describe the issue I'm having:
application(_ application: UIApplication, continue userActivity: NSUserActivity, restorationHandler: @escaping ([UIUserActivityRestoring]?) -> Voidis never called.
(Btw, the README and the examples doesn't support Universal Links, because they rely on AppDelegate's
application(_ app: UIApplication, open url: URL, options: [UIApplicationOpenURLOptionsKey : Any] = [:]) -> Boolinstead of thecontinue userActivityas mentioned above).lapinek commentedon May 29, 2019
@grEvenX, as you are aware, this is not really an AppAuth-iOS specific issue. My (non-production) experience, which I described in #396, was that the authorization endpoint needs to be visited from an intermediate screen in order for Universal Links to be redirected to the app. In the case of the in-app browser tabs, the user needs to navigate to the authorization endpoint. With Safari, it appears, navigation/redirection to the authorization endpoint may occur automatically. Like I said in the other issue, I am not entirely sure why this has to apply to the authentication classes, which AppAuth uses in iOS 11 and 12. Looks like something overlooked by Apple and to be fixed by them.
diptiy commentedon Aug 19, 2020
@WilliamDenniss, same issue is happening in my case as well. I am testing app on iOS simulator, and not on device. is there some dependency for this?
appdev-exaring commentedon Nov 16, 2020
In my case, I don't even get a callback. None of the options open url or user activity. When I dump the request URL and paste it into the notes app and click the link there, everything works just fine. Any idea, what could have gone wrong?
DanCananau commentedon Dec 17, 2020
I have the same issue as above. Universal link works fine from Notes, but is not triggered on a redirect from the identity provider. During the flow there is user interaction. Is there any response to this?
kunwar231 commentedon Jan 26, 2021
Has anyone found an issue to this? On My app, a blank page opens on SFSafariViewController which says 0kb. but it doesn't redirects to the app. But the universal links are correctly implemented as I have checked by using the redirect url in the notes.
PankovSerge commentedon Jan 22, 2022
Same here. I have implemented applinks with wildcard, but didn't get callback even for custom scheme. In case if wildcard not exist in entitlements, everything works as expected.
shobhitpuri commentedon Feb 7, 2022
I'm having the same issue as everyone above. Has anyone been able to solve this?
@PankovSerge Do universal link OAuth work from you if opened from a
SFSafariViewControllerorASWebAuthenticationSessionwithin the app? iOS 15.2Joren-Thijs-KasparSolutions commentedon Jun 12, 2023
I am suffering the same issue today. The in-app browser opens. goes to IDP login screen. I login, and then i'm sent to a blank page (since my redirect uri points to a non existingwebpage) and get stuck there instead of closing the browser and returning to the app. Has anyone been able to get this working with universal links yet?
ChenXiangloong commentedon Jun 14, 2024
@Joren-Thijs-KasparSolutions Did you use ASWebAuthenticationSession? I've suffered the same issue for 3 days, and finally find out universal link is not supported as redirect URL when using ASWebAuthenticationSession.
So the workaround could be:
shobhitpuri commentedon Jun 14, 2024
@XiangloongChen I ended up with custom schema, since it is safe to use custom schema with
ASWebAuthenticationSession, which was made by Apple specifically for authentication purpose. The session information is not shared with Safari or any other apps, so the custom schema would only redirect within the specific app, even if any malicious app registers for it. The official documentation says:Joren-Thijs-KasparSolutions commentedon Jun 19, 2024
@XiangloongChen we ended up doing the same as @shobhitpuri and just used
ASWebAuthenticationSession.krishnaprasadkuchur commentedon Aug 21, 2024
We've been running into the same issue for years now, and decided to stick around with custom schemes. (Given that another app cannot hijack a session initiated by our app). We did file a RADAR a couple of years ago with Apple, since we are not getting the callback once the universal link is loaded in some scenarios such as autofilled passwords from keychain. Yet to get a proper response from them.
I do see a new issue raised: #847 , about switching over to a new
initAPI. has anyone gotten a chance to verify if using this API: https://developer.apple.com/documentation/authenticationservices/aswebauthenticationsession/init(url:callback:completionhandler:)-6nut7?language=objc makes any difference?Moriya-Taichi commentedon Sep 19, 2024
I am facing the same issue.
To investigate whether the problem lies with AppAuth or ASWebAuthenticationSession, I wrote some simple code. I obtained the request URL from OIDAuthorizationRequest and set it as the URL for ASWebAuthenticationSession. I then compared two scenarios: setting the
callbackURLSchemeto the scheme of the redirect URL (in this case, https) similar to how it's done in AppAuth, and using thecallback: ASWebAuthenticationSession.Callbackwith the universal link's host and path, which is available from iOS 17.4 onwards.The results of the tests showed that using the current
callbackURLSchemespecification for ASWebAuthenticationSession did not trigger thecompletionHandlerand did not work. However, when using thecallback: ASWebAuthenticationSession.Callbackspecification available from iOS 17.4 onwards, thecompletionHandlerwas called, and it functioned correctly.From these findings, I understand that AppAuth, which relies on ASWebAuthenticationSession, only works with custom URL schemes.
I verified with the following code.
J6ey commentedon Jul 16, 2025
For complicated reasons I have to use https schemes than custom URL schemes, and I also couldn't get redirect to work with AppAuth's ASWebAuthenticationSession. But a workaround that did work for me was using the custom Safari browser:
This launches the login provider (Okta in my case) in a Safari tab, and after authenticating successfully, it redirects back to the app.
w-goog commentedon Sep 24, 2026
Hi all! Thanks to the generous help of a contributor, we've merged #978. Once the next release lands, you'll be able to use HTTPS links. Please note that this is not the same thing as a "universal link". It's ~functionally the same setup, but requires you to use
webcredentialsin addition toapplinksin your registration file (see the Apple docs).