2

This is what I believe are the security implications of integrating Oauth using embedded webview vs browser in mobile application.

Embedded Webview
* Keep UI for mobile app

 Security implications 
    * Makes phishing easy (especially since no address bar to show url and security)

Browser
* Different UI/Context switch (downsides)

Security - (good) :Less phishing ... can see url in address bar
(bad): Bad app can take over custom url scheme and have access to code.

Is there a way to have a secure mobile solution for oauth integration in mobile?

1

You can use browser + PIN-code verification (oauth_callback=oob). It will become semi-automatic, but will allow you to avoid creating "custom url scheme"

see this article, for example

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.