undefined | Better HN

0 pointsNextgrid5y ago0 comments

You can implement OAuth entirely server-side without any client support beyond displaying a web view. No need to include spyware and the approach is reusable for any OAuth provider.

0 comments

akmarinov5y ago

You can’t, it’s against their policy, if they catch you they’ll revoke your access.

developers.facebook.com/policy/ 8.2 (which states “Native IOS and Android apps that implement Facebook Login must use our official SDKs for login.” This has a help icon next to it that opens a dialog on their site that shows a couple pictures and then explains “Android apps should use the default login behavior defined by the SDK, which may use the web-view Login dialog. On iOS, only kiosk apps may use a web-view Login dialog.”

delfinom5y ago

You understand the subtext here right? They literally want you to install their malware on users devices so you can use their SSO. That's the entire ploy. It's how they ensure their malware spreads.

NextgridOP5y ago

A generic login experience on the web (where the entire login flow is implemented in the browser and the login button just redirects to Safari, including for email/password accounts) should work around it. You can provide technical reasons as excuses for why it's impossible for your app to include edge cases for each login provider to be included natively in the app.

zentiggr5y ago

So do what the GP was hinting at and drop support for Facebook login, drop the SDK, wash your hands and sleep better as well.

zuppy5y ago

this is not how real life works, you don’t get to choose all the features and you can’t quit jobs every time you’re asked to integrate a sdk. also, you are suggesting that it is a good option to drop support for all the customer accounts that have used fb login, this is silly.

sometimes i wonder if you people lost all the connections with the reality... or if you were ever employed.

1 more reply

j / k navigate · click thread line to collapse