Can I use Authorization Code with PKCE Flow for mobile app?

user_15589264 0
Viewed 642

I know that OAuth 2.0 Authorization Code with PKCE Flow is the best practice of OAuth. We plan to use it for our WEB application. But I don't understand how can I use this flow for native UX my mobile app without using a browser for authentication (https://medium.com/klaxit-techblog/openid-connect-for-mobile-apps-fcce3ec3472) Using a browser is unacceptable in our case. The mobile app has a Login Page where user enters their сredentials, 3-th-party authorization is not.

Is it possible to use Authorization Code with PKCE Flow or should I use the OAuth2 Resource Owner Password Grant in my case? Are there any other alternatives?

openid-connect mobile oauth
2 Answers

There are two main options here:

1. AUTHORIZATION CODE FLOW + PKCE

This is typically done by plugging in AppAuth libraries and using a Chrome Custom Tab or ASWebAuthenticationSession window so that the user experience feels integrated. These are the main advantages:

  • Login tends to be more user friendly, and features such as password autofill and single sign on across multiple apps works best

  • You can potentially support many authentication options rather than just user name and password

  • It will do better in third party security reviews (if applicable) since it is the standard option - eg Google use it for mobile Gmail

There is a learning curve in implementing it though. Also, it has a prerequisite of using an Authorization Server and externalising the login user experience. This can be difficult to manage politically at some companies.

2. RESOURCE OWNER PASSWORD GRANT

This is also possible as a short term solution but is deprecated in OAuth 2.1 and will fare less well in security reviews. It limits you to password based sign in and can sometimes result in long lived access tokens (if refresh tokens are not supported). Plus points are that you are more in control of branding and login screen behaviour.

PRACTICAL NEXT STEPS

If you want to look at some working apps that use Code Flow + PKCE, feel free to run the apps from my Quick Start Page. Maybe then you can make an informed decision based on factors such as User Experience and what is most important to your stakeholders.

user_90198850

If you are just looking for first-party signup and login, Ory Kratos is an open-source solution that does not use OAuth2.0 for first-party flows. So you can skip the complexity of OAuth2.0 entirely! A nice bonus is that you don't need to open a browser window (as you always have to do with OAuth2.0, there is no way around it). Check out this tutorial for some concrete implementation details: https://www.ory.sh/login-react-native-authentication-example-api/

user_133626870
Related