2

We have an oauth implementation, which was chosen because of the following reasons:

  • session sharing across different applications
  • easy to reason about the security considerations as oauth is well known and documented

As part of our explorations we also figured that oauth standard discourages using a native UI on the client to collect user credentials, because this would allow oauth clients to get hold of user credentials. While i understand that this is an issue for third party apps that you can't trust, but what about first party applications?

Some of the requirements that our first party apps have:

  • they want a native UI because they want to customize the user journey + don't want to redirect the user
  • the app is a native mobile app, and opening a web browser implementation (which can't be customized much to look like what they want) is unacceptable

Are there any security concerns for allowing first party apps to use a native UI? I understand that we might lose the session sharing capability (which we may possibly enable in some way other than setting a cookie on the oauth domain)

More Info in case it matters: We have a phone number login for oauth, which means the user gets a new OTP every time they login.

Resources:

  • Auth0 has a way to provide native login UI, they do suggest some best practices around it, but seems like they present it as part of their oauth based solution
  • Oauth has a password grant which is now deprecated
  • RFC best practices suggests to not use an embedded browser (which kinda directly correlates to not having a native UI for login either)

2 Answers 2

4

Your requirements contradict to each other. You say OAuth was chosen because it provides:

session sharing across different applications

On the other hand:

... don't want to redirect the user

... opening a web browser ... is unacceptable

If you don't use browser, you don't share session across different applications.

RFC 8252: OAuth 2.0 for Mobile and Native Apps describes some important points. But your following statement regarding this RFC is not correct:

... which kinda directly correlates to not having a native UI either

The RFC recommends to use an external browser for authorization request, i.e. for the step where user is asked for credentials. See section 4.1 there. After authorization, browser returns authorization code to the app, and then the app requests access token, and then uses it in the API requests.

2
  • the actual requirements stand true if /when we provide the oauth setup to third parties. Also if we have multiple web applications then the session sharing using oauth is fine as well. what i am looking for solutions is when I am ok to let go of session sharing, or share it in other ways than a cookie, which is the use case for first party mobile app
    – gaurav5430
    Jan 5, 2023 at 11:11
  • regarding the RFC mentioning using an external browser, i was pointing to the fact that the considerations for which you shouldn't use an embedded browser are similar to using a native ui
    – gaurav5430
    Jan 5, 2023 at 11:13
0

Using the user (external) browser, even for first party applications has several benefits:

  • the user session on the authorization server can be shared between all applications (otherwise, if the user wants to use your application server from different applications he will have to connect once per application);
  • you can use the browser credentials store;
  • you can use WebAuthn;
  • if you want to add a new authentication method (eg. WebAuth, etc.) or harden the authentication process, you only need to update the authorization server code instead of having to update all the first party applications;
  • you can teach the user he should only enter his credentials on the authorization server.
1
  • 1
    sure, these things are good to have, but the user experience on native apps where we have to integrate a custom tab implementation to open the oauth login + the development complexity is a fair point IMO
    – gaurav5430
    Jan 5, 2023 at 8:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .