Shouldn't OAuth2 redirect the user to the external browser instead of just loading the login screen into WebView

Question

what is the correct way of handling OAuth on mobile devices? Android, iOS, etc.. As I am seeing most apps just do load the login screen into an in-app browser like WebView, or so..Isn't it actually trampling the whole principle of OAuth? because I can as a developer easily read the password the user enters into the textfield..Is there a way how to do that with the startActivityForResult pattern (on Android particularly)? Because when the user would enter their login and password into the main system browser, it should be a way more solid approach to maintaning security and trustfulness for the app?

Answer 1

Passing data between the app and the browser

You have to read the response (the reloaded url) from the page, after the user has logged in, to get the authorization code used to request the authentication and refresh tokens. If a (default) browser has to take responsibility for returning the authorization code for you, then it has to have (documented) implementation of receiving such intents for such a result.

Letting the browser know your app's credentials

There is another even more serious problem - usually you request authorization/authentication using your app's credentials (client id + client secret). You put them somewhere in the headers or in the url as parameters. You'll have to provide them to the browser to put them in the headers/url of the request for you.

Combined:

And when the browser has both authorization code and your app's credentials it can acquire auth/refresh tokens for the user's account and not only have access to it but also pretend to be your app. Having in mind that this is the built-in browser that comes with the device the user will be calm because he'll probably trust the manufacturer as he's buying it's device but can the app's developers trust the manufacturers? And when a user chooses a 3rd party browser as default and/or uninstall the built-in one?

In short:

Instead of the user trusting the application he/she installs, both the user and the developer have to trust the 3rd party - the browser