Skip to content

fix(iOS): use ASWebAuthenticationSession instead of WKWebView for login#11

Open
tdhooghe wants to merge 2 commits into
nextcloud:mainfrom
tdhooghe:fix/use-aswebauthenticationsession-for-login
Open

fix(iOS): use ASWebAuthenticationSession instead of WKWebView for login#11
tdhooghe wants to merge 2 commits into
nextcloud:mainfrom
tdhooghe:fix/use-aswebauthenticationsession-for-login

Conversation

@tdhooghe
Copy link
Copy Markdown

@tdhooghe tdhooghe commented Mar 8, 2026

Summary

WKWebView silently fails to complete cross-domain OIDC redirects when Nextcloud delegates authentication to an external Identity Provider (e.g. Authentik, Keycloak, Azure AD). The user authenticates successfully on the IdP, but WKWebView drops the callback redirect back to the Nextcloud origin, leaving Login Flow v2 stuck in a polling loop that never resolves.

This PR replaces WKWebView with ASWebAuthenticationSession on iOS for the login flow. ASWebAuthenticationSession uses the system browser which properly handles:

  • Cross-domain OIDC redirects
  • Passkeys / WebAuthn
  • Deep links

Credentials continue to be obtained via the host app's existing polling mechanism — no changes to the polling API.

macOS retains the WKWebView sheet since ASWebAuthenticationSession behaves differently on that platform.

Changes

  • LoginSheet.swift (new): A ViewModifier that encapsulates the platform difference — ASWebAuthenticationSession on iOS, WKWebView sheet on macOS. The session is held in @State for proper lifetime management, and cancelled automatically when isPresented flips to false (e.g. when polling succeeds), so the system browser sheet doesn't linger. Includes a private SessionCoordinator for the presentation anchor.
  • ServerAddressView.swift: Replaced .webSheet(...) with .loginSheet(...). The view is now fully platform-agnostic — beginWebView() just sets state; the modifier handles presentation. No new #if os() blocks introduced.

Context

This is the same approach taken in the main Nextcloud iOS app (nextcloud/ios#3996), adapted for the shared SwiftNextcloudUI package. All third-party apps consuming this package (Notes, Deck, Talk, etc.) will benefit from this fix.

Closes #10

Test plan

  • iOS: Login with local Nextcloud credentials (no OIDC) — should show system browser sheet, polling completes, app logs in
  • iOS: Login with OIDC provider (e.g. Authentik) — cross-domain redirect should complete, polling picks up credentials
  • iOS: Cancel login by dismissing the browser sheet — should return to server address screen
  • iOS: Polling succeeds while browser sheet is open — browser sheet should dismiss automatically
  • macOS: Login should continue to use the WKWebView sheet (no behavioral change)

@tdhooghe
Copy link
Copy Markdown
Author

tdhooghe commented Mar 8, 2026

@i2h3 @mpivchev — would appreciate your review on this.

@mpivchev: this applies the same ASWebAuthenticationSession approach you implemented for the main iOS app in nextcloud/ios#3996, adapted for this shared package so all consuming apps (Notes, Deck, etc.) benefit.

@i2h3: the change is encapsulated in a single new LoginSheet view modifier — ServerAddressView stays platform-agnostic. macOS behavior is unchanged (still uses the WKWebView sheet).

@tdhooghe tdhooghe force-pushed the fix/use-aswebauthenticationsession-for-login branch 5 times, most recently from 326ae0d to 34d8f9b Compare March 8, 2026 13:51
WKWebView silently fails to complete cross-domain OIDC redirects (e.g.
when Nextcloud delegates authentication to an external IdP like Authentik).
The user authenticates successfully on the IdP side, but WKWebView drops
the callback redirect back to the Nextcloud origin, leaving the login
flow stuck in a polling loop that never resolves.

Replace WKWebView with ASWebAuthenticationSession on iOS via a new
LoginSheet view modifier that encapsulates the platform difference:
- iOS: ASWebAuthenticationSession (system browser, handles OIDC/passkeys)
- macOS: WKWebView sheet (unchanged behavior)

ServerAddressView is now platform-agnostic — it just sets isPresented
and the modifier does the right thing per platform. Credentials continue
to be obtained via the host app's existing polling mechanism.

Ref: nextcloud/ios#3996 (same fix applied to the main iOS app)

Signed-off-by: Thomas Dhooghe <61279337+tdhooghe@users.noreply.github.com>
@tdhooghe tdhooghe force-pushed the fix/use-aswebauthenticationsession-for-login branch from 34d8f9b to acfa573 Compare March 8, 2026 13:51
Copy link
Copy Markdown
Collaborator

@i2h3 i2h3 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks fine to me, though I have only reviewed the code changes and did not test it in context of the iOS apps. Please verify, @mpivchev and @marinofaggiana.

@mpivchev
Copy link
Copy Markdown
Collaborator

mpivchev commented Mar 9, 2026

I need to test this with iOS Files and if possible replace the UIKit login with this. Will update soon.

@i2h3
Copy link
Copy Markdown
Collaborator

i2h3 commented Mar 9, 2026

@mpivchev You can also test it with Nextcloud Notes for iOS which uses this already.

@tdhooghe tdhooghe force-pushed the fix/use-aswebauthenticationsession-for-login branch from ddc0764 to 41798f7 Compare March 10, 2026 09:32
Signed-off-by: Thomas Dhooghe <61279337+tdhooghe@users.noreply.github.com>
Made-with: Cursor
@tdhooghe tdhooghe force-pushed the fix/use-aswebauthenticationsession-for-login branch from 41798f7 to a51116f Compare March 10, 2026 09:34
@tdhooghe
Copy link
Copy Markdown
Author

@i2h3 that was indeed the app that caused me to raise this PR 🙂

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Login flow fails with OIDC providers due to WKWebView cross-domain redirect limitation

3 participants