Re: [OAUTH-WG] popular apps that use appauth?

[David Waite <[e-mail]>]

> On Feb 24, 2019, at 10:43 AM, William Denniss <wdenniss=[e-mail]> wrote:
> 
> For 1P sign-in, there are several good reasons to go with ASWebAuthenticationSession, like syncing the signed-in session with Safari and using it if it already exists.

With enterprise 3P, you’ll have to use some web agent for authentication pretty much no matter what, and you’ll almost certainly get pressure to use ASWebAuthenticationSession, and/or potentially lose deals to competitors during product evaluations. It is simply what is required for robust integration into a corporate infrastructure.

For 1P on iOS, it depends on the complexity of authentication for first party. If you are just doing password and maybe SMS-based challenges, there is decent enough native app integration for password sharing and SMS keyboard for that to keep conversions high, even with having to authenticate twice.

However, if you want to authenticate the device (even pseudonymously with session cookies) or do other factors, the authentication is simpler with ASWebAuthenticationSession. Which means your life will be easier if you have more complex authentication requirements anywhere on your roadmap to just start off using ASWebAuthenticationSession.

It is likely that future authentication technologies like WebAuthn will not work with an embedded web view. The ability to arbitrarily inject javascript means that apps can phish webauthn responses for domains via embedded web views.

-DW