{"action":"created","issue":{"url":"https://api.github.com/repos/openid/AppAuth-iOS/issues/31","repository_url":"https://api.github.com/repos/openid/AppAuth-iOS","labels_url":"https://api.github.com/repos/openid/AppAuth-iOS/issues/31/labels{/name}","comments_url":"https://api.github.com/repos/openid/AppAuth-iOS/issues/31/comments","events_url":"https://api.github.com/repos/openid/AppAuth-iOS/issues/31/events","html_url":"https://github.com/openid/AppAuth-iOS/issues/31","id":163552485,"number":31,"title":"Browser Title Bar method?","user":{"login":"mookie5dc","id":181267,"avatar_url":"https://avatars.githubusercontent.com/u/181267?v=3","gravatar_id":"","url":"https://api.github.com/users/mookie5dc","html_url":"https://github.com/mookie5dc","followers_url":"https://api.github.com/users/mookie5dc/followers","following_url":"https://api.github.com/users/mookie5dc/following{/other_user}","gists_url":"https://api.github.com/users/mookie5dc/gists{/gist_id}","starred_url":"https://api.github.com/users/mookie5dc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mookie5dc/subscriptions","organizations_url":"https://api.github.com/users/mookie5dc/orgs","repos_url":"https://api.github.com/users/mookie5dc/repos","events_url":"https://api.github.com/users/mookie5dc/events{/privacy}","received_events_url":"https://api.github.com/users/mookie5dc/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-07-03T08:16:06Z","updated_at":"2016-07-04T00:59:40Z","closed_at":null,"body":"I noticed from the answers in this question on the android library(https://github.com/openid/AppAuth-Android/issues/71) that the use of urn:ietf:wg:oauth:2.0:oob is a hack.  Does this library support the browser title bar method at all?  I'm trying to use the MSGraph API and unfortunately, their app registration forces you to use that for the redirect uri and doesn't allow you to change it to a reverse dns format.  Is there a possibility to retrieve the auth code via the browser title bar method with this library?"},"comment":{"url":"https://api.github.com/repos/openid/AppAuth-iOS/issues/comments/230186210","html_url":"https://github.com/openid/AppAuth-iOS/issues/31#issuecomment-230186210","issue_url":"https://api.github.com/repos/openid/AppAuth-iOS/issues/31","id":230186210,"user":{"login":"WilliamDenniss","id":445150,"avatar_url":"https://avatars.githubusercontent.com/u/445150?v=3","gravatar_id":"","url":"https://api.github.com/users/WilliamDenniss","html_url":"https://github.com/WilliamDenniss","followers_url":"https://api.github.com/users/WilliamDenniss/followers","following_url":"https://api.github.com/users/WilliamDenniss/following{/other_user}","gists_url":"https://api.github.com/users/WilliamDenniss/gists{/gist_id}","starred_url":"https://api.github.com/users/WilliamDenniss/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/WilliamDenniss/subscriptions","organizations_url":"https://api.github.com/users/WilliamDenniss/orgs","repos_url":"https://api.github.com/users/WilliamDenniss/repos","events_url":"https://api.github.com/users/WilliamDenniss/events{/privacy}","received_events_url":"https://api.github.com/users/WilliamDenniss/received_events","type":"User","site_admin":false},"created_at":"2016-07-04T00:59:40Z","updated_at":"2016-07-04T00:59:40Z","body":"The browser title bar cannot be read from `SFSafariViewController` or mobile Safari.\r\n\r\nHere is how I would support an OAuth provider who cannot redirect to a custom URI scheme on iOS:\r\n\r\n1. Register a universal link, claimed by your app, as the redirect URI at the authorization server, say `https://example.com/oauth2redirect`.  For iOS 9+ users, they will get the authorization response directly in your app (since your app has claimed the link) – and you just pipe the URL into `OIDAuthorizationFlowSession::resumeAuthorizationFlowWithURL`, and you're done.\r\n2. If you need to support iOS 8 and below, then what you can do is as a fall back, actually implement the endpoint `https://example.com/oauth2redirect?<query>` on you server, where all it does is a 302 redirect to `com.example.app:/oauth2redirect?<query>` (preserving the query string).  Your app gets the URL, which you pipe into `resumeAuthorizationFlowWithURL` as with the universal link.\r\n\r\nIn this way, all your iOS users can receive the redirect. Those on iOS 9 are just a little more secure as the browser will send the response directly to your app (and only your app). On iOS 8, users will load your server's endpoint in the browser, which redirects them to the custom URI scheme – two entry points to your app for receiving the authorization code, same end result.\r\n\r\nThe only way to hack AppAuth to use `urn:ietf:wg:oauth:2.0:oob` (which I don't recommend) would be to present the authorization request in a `UIWebView`, which allows for inspection of the HTML and retrieval of the code. This is technically possible, but it goes against the recommendations of [OAuth 2.0 for Native Apps](https://tools.ietf.org/html/draft-ietf-oauth-native-apps) for both usability and security reasons, which is why we don't support it."}}
{"actor":{"display_login":"WilliamDenniss"}}