0

We want to use deeplink with a schema to login using SAML in our Mobile Apps:

i.e

ourschema://host?code=12345

The problem is that other apps on iOS can read the content of ourschema:// including the code parameter.

On Android I think I will be asked which application should complete the action.

We are thinking about encrypting the code value with symmetric key which we get via HTTP(s) API call, i-e

https://host/getkey

ourschema://host?code=<encrypted>

Decrypt in mobile. Key will be used only once. This will solve the problem of other apps intercepting our schema, since HTTPs cannot be intercepted.

Is this secure enough?

How would you handle secure SAML login via Webpage?

1
  • Found out that PKCE is what I should use
    – dev
    Jan 23 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.