23
Views
0
Comments
[InAppBrowser Plugin] How to avoid CSRF-errors for ios-users when doing external login trough InAppBrowser?
inappbrowser-plugin
Mobile icon
Forge asset by OutSystems
Application Type
Mobile

Hi,
For over a year we are having lots of complaints by ios-users that are kicked out the app after a few seconds.  3 Support-tickets logged and  still no solution. 
The last support-ticket claimed it is an ios-issue and not an outsystems-issue.  What we see in the error logs is invalid login and CSRF-errors because the authentiation cookie is empty.
We use Auth0 as IDP, so when logging in the auth0-url is opened in the InAppBrowser.
On PRD we use mabs11.1 and InAppBrowserPlugin is v2.4.10
On TST everything related is on the latest version (IDP, IDP_Mobile, InAppBrowserEvents, InAppBrowserPlugin) and the issue is still there.
The advise we got was on platform config to enable the checkbox "Disable Max-Age for Anonymous cookies in Mobile/Reactive" but it doesn't help. This setting is already enabled for more than a month but don't see a significant drop on those login-errors.
According to OS-Support , the issue is https://bugs.webkit.org/show_bug.cgi?id=272325

We can't be the only company that use inAppBrowser to redirect to Auth0.

Our platform version is  11.35.0 

What can we still do?

Thx in Advance,

Geert Uyttendaele

  

Community GuidelinesBe kind and respectful, give credit to the original source of content, and search for duplicates before posting.