I've been researching this topic for days, but can't really find any solid reference surrounding this topic..
The idea is providing social login for mobile client apps. That's it. Sharing, accessing user's data, and other social features are not required.
Personally, I'd imagine (especially for cross platform games) that ideally you'd just open a web page where the authentication process takes place. This has the advantage of working across any platform without the need to bloat the app with unnecessarily bloated social SDKs. It also works consistently across platforms, give you test the web view presentation well enough.
Yet, most resource I keep finding keep pointing to SDKs to be used, or using OAuth APIs to initiate the auth process. This leaves me wondering if it was possible to securely implement web based auth flow on mobile clients...
Given a cross-platform app has a requirement to provide specific social login features (through Google+ and Facebook):
- Would it make sense to redirect the user to a special url within the app's website to perform the auth, then receive a callback from within the app itself?
- Are there any security (or otherwise important) constraints being compromised with such an approach that I'm not considering?
- Why isn't this approach popular (especially games)? The only game I've seen go with this approach so far is Pokemon Go on iOS. It shows a webview that logs you into Google+.
To understand the flow a little bit more, and grasp the context of web auth on mobile device, you can see here an overview of how it evolved in recent iOS and Android releases (2015):
In order to realize what I mean by bloated SDKs, just take a look for yourself at these examples:
Some issues that the previous SDKs introduce:
- Can't use IL2Cpp on Android (facebook SDK bug)
- Can't use Bitcode anymore (Google SDK disables that)
- Must introduce Cocoapods, which makes the build process less portable