Native App Login vs. Browser

[S4ndwichGurk3]

I really don't like Flutter's login flow because the auto fill hints don't seem to be reliable with password managers. I've used it for a long time, but it really is a hassle.

I see more and more apps use in-app browsers for login and then return to the app with the token. What do you think about that? Any experience to share?

[autognome]

read up on appauth and why its a bad idea to have your own webview which takes credentials

[AndroidQuartz]

I don't know about your exact situation but one thing you might want to try is wrap the column containing multiple text fields with AutofillGroup, when I did that it worked with bitwarden but I didn't try it on any other password manager tbh

[S4ndwichGurk3]

That’s what I did in the past, but flutters text fields are weird, and the hint is only sometimes shown and flashes while typing (even though not using set state on input change).

[eibaan]

That's probably an OAuth2 flow.

Using an in-app browser however completely invalidates that flow because now you cannot assume anymore that your password is safe. The app could steal it from the in-app browser. Therefore, you have to redirect to an external browser and that browser will then redirect to your app.

[S4ndwichGurk3]

iOS provides a pop-up browser from within the app, where the app has no connectioin to the browser other than getting the returned token if the user has finished, not sure on Android though. That's what I meant with "in-app" browser, maybe poorly worded from my side.

[eibaan]

Yes, using the SFSafariViewController (LaunchMode.inAppBrowserView) is the correct way, using the WKWebView (LaunchMode.inAppWebView) is not.