CB-14013: (android) Change the InAppBrowser to allow custom schemes for oAuth #263

SailingSteve · 2018-04-05T20:14:01Z

Platforms affected

Android

What does this PR do?

Allows oAuth redirects that return to Android with custom schemes like "twitter://code=nnn" to be
acted on by the InAppBrowser. This is needed for oAuth 2.0 flow.

This PR builds on /pull/99 and /pull/261 and also builds on a good suggestion from NGumby and comments about viability from infil00p

Here is my actual working JavaScript app code from https://github.com/WeVote/WebApp/blob/develop/src/js/components/Twitter/TwitterSignIn.jsx

          inAppBrowserRef.addEventListener('customscheme', function (event) {
            oAuthLog("customscheme: ", event.url);
            TwitterSignIn.handleTwitterOpenURL(event.url);

            inAppBrowserRef.close();
          });

You configure the allowable schemes in a comma separated list in a new preference. This implements whitelisting for the allowed schemes, but doesn't use the Cordova Whitelist plugin -- this approach seemed much simpler and safer.

See my actual config.xml at https://github.com/wevote/WeVoteCordova/blob/master/config.xml

   <preference name="AllowedSchemes" value="mycoolapp,wevotetwitterscheme" />

What testing has been done on this change?

It has been tested and is working in my app https://github.com/wevote/WeVoteCordova. I tested to make sure that single and multiple schemes in the "AllowedSchemes" preference worked as expected.

Checklist

Reported an issue in the JIRA database
Commit message follows the format: "CB-3232: (android) Fix bug with resolving file paths", where CB-xxxx is the JIRA ID & "android" is the platform affected.
Added automated test coverage as appropriate for this change.

…ing. Newtest in shouldOverrideUrlLoading, to allow whitelisted custom schemes like"mycoolapp://" inappbrowser.js: Added "customscheme" channel.

…ing of "AllowedSchemes" in a new preference configuration item. There is a new check in shouldOverrideUrlLoading, to allow whitelisted custom schemes like "mycoolapp://" inappbrowser.js: Added "customscheme" channel.

check for whitelisting custom schemes via a new "AllowedSchemes" preference configuration item. Allows custom schemes like "mycoolapp://" or "wevotetwitterscheme://" In file inappbrowser.js: Added new "customscheme" channel.

Added InAppBrowser support for the oAuth redirect scheme, this relies on a PR that I made to Cordova to allow schemes apache/cordova-plugin-inappbrowser#263 which they are likely to approve, but if not we can work off of the fork. Moved all the iOS twitter scheme processing out of Application.js and into TwitterSignIn.jsx, and enhanced it for Android. Some small styling changes to remove the "ios7plus-spacer" which is not needed for Android, since they don't make the top line menu space available for the application. Made some more changes to use logging.js based on the new defines in config.js. Big changes to www/index.html Content Security Policy, debugged to find out what we acutally need.

SailingSteve · 2018-04-05T22:19:14Z

PR is here #263

Added InAppBrowser support for the oAuth redirect scheme, this relies on a PR that I made to Cordova to allow schemes apache/cordova-plugin-inappbrowser#263 which they are likely to approve, but if not we can work off of the fork. Moved all the iOS twitter scheme processing out of Application.js and into TwitterSignIn.jsx, and enhanced it for Android. Some small styling changes to remove the iOS

timbru31 · 2018-05-02T17:49:58Z

@SailingSteve possible to add support for staging+mycoolapp? Currently the plus sign is excluded from your regexp (^[a-z]*://.*?$). Numbers would be great, too. Our URL scheme is d2d...

edit PR is #269

wvengen · 2018-06-27T12:04:31Z

Wow, this is huge as it (finally) allows 'events' from the inAppBrowser to the Cordova app. Its use goes way beyond OAuth 2. Thanks a lot!

As a sidenote: I do see a use-case for allowing http and https in AllowedSchemes: deciding in the Cordova app whether a URL needs to be loaded or not. This would allow for more easily deciding which URLs are opened in the app, and which URLs are opened in the system web browser.

boynet · 2018-11-27T17:20:37Z

I started testing it and I ran into bug, the event only working on the first time so a page with this simple html loaded into inAppBrowser:

config:
<preference name="AllowedSchemes" value="whatsapp,twitter" />
....
html:
<html>
<body>
<a href="whatsapp://send?text=test">click to send</a>
</body>
</html>

event:
        inAppBrowser.addEventListener('customscheme', function (event) {
            console.log(event);
        });

the first click everything is fine, the second click no longer trigger the event

janpio · 2018-11-27T17:35:35Z

Can you please create a new issue @boynet? This will be forgotten here, just link to the PR in your description for context. Thanks for taking the time to report this!

customautosys · 2020-05-25T04:17:33Z

Why not just make it launch an intent to open the default system app for the custom scheme? Something like https://github.com/ljcljc/cordova-plugin-inappbrowser

SailingSteve added 7 commits April 4, 2018 08:22

InAppBrowser.java: New method isURLWhileListed to check for whitelist…

44d9bb0

…ing. Newtest in shouldOverrideUrlLoading, to allow whitelisted custom schemes like"mycoolapp://" inappbrowser.js: Added "customscheme" channel.

InAppBrowser.java: New method isURLWhileListed to check for whitelist…

a6c7b54

…ing. Newtest in shouldOverrideUrlLoading, to allow whitelisted custom schemes like"mycoolapp://" inappbrowser.js: Added "customscheme" channel.

InAppBrowser.java: New method isURLWhileListed to check for whitelist…

2d69afc

…ing. Newtest in shouldOverrideUrlLoading, to allow whitelisted custom schemes like"mycoolapp://" inappbrowser.js: Added "customscheme" channel.

SailingSteve mentioned this pull request Apr 6, 2018

WebApp changes for Cordova Android -- oAuth through Twitter now works wevote/WebApp#1440

Merged

infil00p merged commit 50db5c4 into apache:master Apr 12, 2018

timbru31 mentioned this pull request May 2, 2018

CB-14061: (android) comply with RFC 3986 for custom URL scheme handling #269

Merged

3 tasks

wvengen mentioned this pull request Jul 3, 2018

CB-14187: (ios) Change the InAppBrowser to allow custom schemes #274

Open

3 tasks

boynet mentioned this pull request Nov 27, 2018

documenting the custom schemes handling #356

Open

boynet mentioned this pull request Nov 28, 2018

documenting the custom schemes handling #357

Open

3 tasks

brodycj mentioned this pull request Dec 30, 2019

Update InAppBrowser.java to allow custom URI schemes and intents #551

Open

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CB-14013: (android) Change the InAppBrowser to allow custom schemes for oAuth #263

CB-14013: (android) Change the InAppBrowser to allow custom schemes for oAuth #263

SailingSteve commented Apr 5, 2018 •

edited

Loading

SailingSteve commented Apr 5, 2018

timbru31 commented May 2, 2018 •

edited

Loading

wvengen commented Jun 27, 2018

boynet commented Nov 27, 2018

janpio commented Nov 27, 2018

customautosys commented May 25, 2020

CB-14013: (android) Change the InAppBrowser to allow custom schemes for oAuth #263

CB-14013: (android) Change the InAppBrowser to allow custom schemes for oAuth #263

Conversation

SailingSteve commented Apr 5, 2018 • edited Loading

Platforms affected

What does this PR do?

What testing has been done on this change?

Checklist

SailingSteve commented Apr 5, 2018

timbru31 commented May 2, 2018 • edited Loading

wvengen commented Jun 27, 2018

boynet commented Nov 27, 2018

janpio commented Nov 27, 2018

customautosys commented May 25, 2020

SailingSteve commented Apr 5, 2018 •

edited

Loading

timbru31 commented May 2, 2018 •

edited

Loading