0

I installed the Android Pocket app and logged in. My default browser is Firefox, which is already logged in to my Firefox account. This meant I did not have to enter my Firefox account password. Presumably the Pocket login flow used a Custom Tab...

Wait.

Can any app do this?

If Pocket can harvest a login session out of Firefox, what stops arbitrary apps harvesting arbitrary logins or private content?

Does the website perhaps control this by

  • requiring user interaction - the "sign in" button" I had to press
  • and the Android app cannot spoof user interaction (unless it has special permissions)
  • and then a new login session secret is sent to the app by the webserver through a separate channel?
Improve this question
0

1 Answer 1

Reset to default
0

Right. At least, that is how it would work for a Google Account using OAuth 2.0. As implied in the question, I assume the principles can be generalized as applying to multiple apps, including Pocket with a Firefox Account.

disallowed_useragent

The authorization endpoint is displayed inside an embedded user-agent disallowed by Google's OAuth 2.0 Policies.

Android developers may encounter this error message when opening authorization requests in android.webkit.WebView. Developers should instead use Android libraries such as Google Sign-In for Android or OpenID Foundation's AppAuth for Android.

Web developers may encounter this error when an Android app opens a general web link in an embedded user-agent and a user navigates to Google's OAuth 2.0 authorization endpoint from your site. Developers should allow general links to open in the default link handler of the operating system, which includes both Android App Links handlers or the default browser app. The Android Custom Tabs library is also a supported option.

Use secure browsers

A developer must not direct a Google OAuth 2.0 authorization request to an embedded user-agent under the developer's control. Embedded user-agents include, but are not limited to, software libraries that allow a developer to insert arbitrary scripts, alter the default routing of a request to the Google OAuth server, or access session cookies. All browsing environments must allow the user to verify the current connection to the Google OAuth server including the requested URI and connection security information.

8.6. Client Impersonation

As stated in Section 10.2 of OAuth 2.0 [RFC6749], the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction

The last document appears to suggest that the app could receive the login session secret by registering a custom URL. Although, I tried disabling "open supported links" for Pocket, and the Firefox Account login flow still worked without a hiccup. It sounds to me like the custom URL method would be unnecessary and fragile.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .