I'm working on an app that (for now) is essentially a WebView wrapper over an existing website.
There are social logins there, but when you click on them in the context of the app, the oAuth providers say the WebView user agent is not allowed. This is because in 2021 oAuth stopped allowing social logins via WebViews due to the risk of key-logging. I messed around with spoofing the user agent, but that both felt wrong and also didn't work for all social logins.
What would you recommend doing in this situation? My goal is to somehow allow people to log in with Google/Facebook. I'm open to ideas - e.g.
- implementing native login solutions and passing tokens back to the main site the WebView
- opening an external browser and doing the login action in this higher security area
Where I'm having trouble is the specifics of making this all connect together. If anyone has any experience here, I'd love to hear from them.