We want to use deeplink with a schema to login using SAML in our Mobile Apps:
The problem is that other apps on iOS can read the content of ourschema:// including the code parameter.
On Android I think I will be asked which application should complete the action.
We are thinking about encrypting the code value with symmetric key which we get via HTTP(s) API call, i-e
Decrypt in mobile. Key will be used only once. This will solve the problem of other apps intercepting our schema, since HTTPs cannot be intercepted.
Is this secure enough?
How would you handle secure SAML login via Webpage?