7

Say you have a smartphone with two browsers, DefaultBrowser and OtherBrowser.

  • You visit the webshop by opening Otherbrowser, and proceed through the cart steps
  • At the end, you go from OtherBrowser to PaymentApp to pay.
  • After you've paid, PaymentApp closes and opens the confirmation URL in the DefaultBrowser.

And that last step is a problem. DefaultBrowser doesn't have the right session, OtherBrowser does. The PaymentApp does as expected, it opens a browser instance and the OS picks the set default.

I strongly prefer not to set a new session in DefaultBrowser based and feedback parameters (like order_id) as I want to keep it as secure and transparent as possible. Extra downside of this is that the real session is still alive in OtherBrowser which might lead to other problems or confusion.

Does anyone have a solution for this? I'm not perse looking for some code, instead im looking for a concept which could fix it as good as possible.

Some additional information:

  • We do not own the app. I can contact them, but it's a bank app and I'm a mere peasant.
  • Other big webshops have the exact same situation.
  • This is not brand related, Android/iOS (and likely WinPhone) have this problem.
  • This is not app related, we tried a few bank apps, all have this exact problem.

migrated from webmasters.stackexchange.com Jul 1 '16 at 18:11

This question came from our site for pro webmasters.

  • Since you're looking for a way to securely pass session information between a banking app and mobile browsers, SEC.SE should have valuable input. Advise updating your title before doing so. – user2320464 Jul 2 '16 at 20:29
  • 2
    I'd expect this to require significant changes to the payment app, so if you're not its author, you'll have little choice. – CodesInChaos Jul 4 '16 at 7:20
  • I agree, and because of that I'm hoping someone has a nice Plan B solution. – Martijn Jul 4 '16 at 11:11
  • I think the only possible way is for you to securely create a new session in the default browser. – Chamindu Jul 17 '16 at 9:57
1

On both Android and iOS the PaymentApp can open any browser it wants. If it's made to always open a default browser, the only way to force it opening another browser is by changing a default browser (btw this only works on Android, not on iOS). If you have control over the PaymentApp, you can force it to open another browser. On Android the mechanism is called "intents" and "deep links", on iOS it's done via "custom url schemes" or "universal links".

Every browser has a special way to identify itself (by a web page code) and a way to open it (from any native app). The way it could work is that the webshop should identify the browser, and pass that information to the PaymentApp. Later on the PaymentApp needs to use the information to open a right browser.

Since you don't control the PaymentApp (and I suppose they don't care fixing it for you), the only solution would be to inform the webshop client that the chosen payment method requires Safari or Chrome, and reopen the page in that browser instead (passing a session ID).

I'm a mobile web browsers software developer, and this is a known problem for any 3rd party browser app, especially on iOS where Safari usurps the system.

See docs: https://developer.android.com/training/app-indexing/deep-linking.html https://developer.apple.com/library/ios/documentation/General/Conceptual/AppSearch/UniversalLinks.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.