We're making changes to the Community, so you may have received some notifications - thanks for your patience and welcome back. Learn more here.
Forum Discussion
IOS ASWebAuthenticationSession for OAuth
Previously I used a WKWebView browser control to perform the OAUth. This allowed me to trap the redirect URL to obtain the access code. My redirect URL was http://localhost/Auth Now I am using the ...
Thanks, I used the Code flow as it looked more secure.
It would seem that custom URL schemes would be as secure as LOCALHOST ... both of which can only work on the user's device.
Greg-DB
Dropbox Staff
Dropbox StaffThanks! Based on the code you shared, I see that you're using the "code" flow (i.e., 'response_type=code'). For the code flow, only "https://" is allowed in the redirect URI (unless on localhost), so "myapp://" wouldn't be allowed.
Instead, for client-side applications like this, you should use the "token" flow, i.e., 'response_type=token'. That does allow custom URL schemes in redirect URIs, such as "myapp://".
For more information on how to use the token flow, please refer to the /oauth2/authorize documentation.
