I have a web application (React js with Kotlin backend) that has normal email + pw (plus PIN) login, and it also supports 3rd party authentication (Google and Facebook). It works on mobile and web, however, when I open my webpage through Facebook app - which opens it's own browser - and try to log in with 3rd party authentication, I can click on that "Continue as me" button, but then the page refreshes and I'm not logged in. I saw the same thing happen on other sites too, e.g. Figma, Pinterest, etc. I thought it's impossible to log in this way anymore, however, I just noticed that you can actually log in to Stackoverflow this way (so facebook app -> facebook browser -> stack overflow -> 3rd party auth and it works).
Has anyone figured it out how it was possible for Stackoverflow to do this?
Ok, I found the solution. The problem was that when a user clicked on 'Login with FB' button on my site, I sent a request to fb to get back a content of a login window and I created a pop up window where I rendered it, I put on a listener on that pop up window and once it was done, then I got the access token and sent it to backend and logged the user in. On a normal browser it works perfect (both pc and mobile) but as I mentioned above it didn't work in an in app browser like facebook app.
The issue was that facebook app opens a website in it's own browser that doesn't handle any pop ups, so after a successful authentication I saw that nothing happened and it was because we were not redirected to the original window where we should have, and it had the token in the url. So the solution was instead of making this pop up window for FB login, just redirect the user to the fb login page (and stay on the same window), and once the login is successful, just handle the token as is.
I was playing with inspect element the other day and what I did was I opened facebook in two tabs and logged out from the other tab. As soon as I returned back to the logged in tab, it showed me Login modal. How did it check instantly as no service request was made to allow them to check if the user has logged out.
Same happens with manual cookie clearance from Application tab in the developers console and also if you deactivate your account from app, the website open on your laptop shows to login. How does that happen so instantly? Is that a Websocket?
For a non-banking enterprise web app, is it recommended to allow the user to log into the app on pressing back button and then forward button on a browser, when the user has logged in and is on the landing page but has not logged out.
I am using webservice in my app. I have set one button login with facebook button, that drag user to safari browser and open facebook login page. Here I have not used Facebook API, all things are coming from PHP side,
now I need the user back to application which is in background when he successfully Logs in..
I have set my URL schemes as "myapp" and when user logs in successfully in PHP side I have set url to open is "myapp://" so I can get back to my app.
But here problem is when ever url "myapp://" gets called it automatically converted to "http://domainname.myapp://" so safari is not letting the user to go back to application and it stays on the bowser.
where I am getting wrong?
I have an app that presents a UIWebView pointing to my own server. I have a Facebook Like button on some pages inside the UIWebView.
I have it working now, but the login screen is way too big for the phone screen. I would like to present a nicer login dialog such as the one in the Facebook iPhone API, and then continue back to the web view.
The Facebook iPhone SDK has support for a login button and iPhone-friendly login screen, but it assumes that a user will click a login button before doing anything Facebook related. I would like the Like button to just appear, and to bring up the iPhone login screen only when necessary.
I have monitored HTTP requests from my web view, and it looks like I could intercept the login request there, and present the login dialog. However, it seems that this would be fragile, because if Facebook changes those calls then my app will no longer work. Is there a more elegant way to do this?