What I have read from oauth spec is that the authorization server url should be visible to the user. From RFC6819 - OAuth 2.0 Security, it is stated that:

A malicious application could attempt to phish end-user passwords by misusing an embedded browser in the end-user authorization process, or by presenting its own user interface instead of allowing a trusted system browser to render the authorization user interface. By doing so, the usual visual trust mechanisms may be bypassed (e.g., Transport Layer Security (TLS) confirmation, web site mechanisms). By using an embedded or internal client application user interface, the client application has access to additional information to which it should not have access (e.g., UID/password).

Google android provides a feature call android custom tabs to help implement the spec. Google also does not accept request from webviews for Google Login according to this article.

When I go to the Playstore, I see very few apps using Android custom tabs to launch the login page; most apps I have seen use webviews.

Why is this trend? Am I missing something here?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.