Sign in with Apple returns nonce on one device (iPhone X iOS 13.3.1) but not on others (iPhone iOS 13.3, iPad iOS 13.1.3, iOS 13.2.3). Based on the discussion at https://forums.developer.apple.com/thread/125419, it seems that all iOS 13 devices that are not updated to iOS 13.3.1 and that are using the native flow cannot use nonces. By native flow, I am referring to
.
Note: the web flow works fine on the aforementioned devices. By web flow, I am referring to
.
However, I am sure this cannot be the case, as Sign in with Apple works fine on PRE-iOS 13.3.1 devices with apps like Kayak (assuming Kayak uses nonces).
Why is nonce_supported: false being returned in the JWT from Apple?
According to https://developer.apple.com/documentation/signinwithapplerestapi/authenticating_users_with_sign_in_with_apple,
"nonce_supported A Boolean value that indicates whether the transaction is on a nonce-supported platform. If you sent a nonce in the authorization request but do not see the nonce claim in the ID token, check this claim to determine how to proceed. If this claim returns true you should treat nonce as mandatory and fail the transaction; otherwise, you can proceed treating the nonce as optional." Do iOS 13 devices that are pre 13.3.1 just not support nonces?