I can't find an answer to this simple question about delegated authorisation: When using a mobile app, how can a user be sure that a consent screen (let's say Google or Facebook) is a real one? The app could fake the consent screen and get the user's credential information when he tries to log in, no?

On a web page, you can check the URL in the consent screen page, and the padlock icon, but what if you just have a webview in a mobile app?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.