Hey,

i just saw that AppAuth for iOS finally implemented a way to end the session. see: https://github.com/openid/AppAuth-iOS/pull/407

Unfortunately there is no implementation for Android, yet. Do you plan to add this to your library? Even if it is just for iOS at the moment.

Greetings

I'm trying to use flutter_appauth to connect to an IdentityServer. I use a client secret. On Android it works. But on IOS AuthorizeAndExchangeCode never gets a result and hangs.

I've set Url callbacks on IOS like this:

	<key>CFBundleURLTypes</key>
	<array>
		<dict>
			<key>CFBundleTypeRole</key>
			<string>Editor</string>
			<key>CFBundleURLName</key>
			<string>com.app.my</string>
			<key>CFBundleURLSchemes</key>
			<array>
				<string>com.app.my://login-callback</string>
			</array>
		</dict>
	</array>

Is there something else that might be wrong? Is there a way to test that the CFBundleURLTypes are used and can be called by the app? I have no errors, the app only hangs. I tried both the example from this repository and the example from Auth0.

Hello @MaikuB, i do have a problem with the app which i cannot figure it out. Basically, my app has 3 different flavors, configured correctly on both Android and iOS. Every build on Android works fine, the problem comes with iOS. It opens the page, but the ://oauthredirect never works.

in iOS i get strange webview logs but i guess is just part of the webview system. Could you help me figure this out ?

Note that the endpoint on both Android and iOS is the same, so its not an endpoint problem. Thanks

Hi all,

Is there any way to use this in a flutter desktop version? I am using it on Android and iOS at the moment, but that's native with the AppAuth SDK. Maybe the JS one can be used on the desktop/web? Apologies, I did a search for desktop in all issues, but there wasn't one specifically asking.

Thanks.

Hi there, I'm sure this is not specific to flutter_appauth but I'm not sure where else to ask this question. So my apologies for doing this as an issue.

I have my custom scheme setup and I've got flutter_appauth sending a code to my server which has a valid token ready to respond with.

I've tried responding with my-app-scheme:/instagram-auth?token=foo and the browser window closes as expected but nothing returns from AppAuth.authorizeAndExchangeCode

So my question is what should I be returning to catch the attention of App Auth and complete the token exchange?

It seems like flutter_app_auth would need to know the scheme to listen on?

I found this documentation but it is not clear on what needs to be returned and I don't see any guidelines for AppAuth itself

https://tools.ietf.org/html/rfc8252#section-7

I'm not sure exactly how to fix this issue, but it seems that the authorizationService is disposed while the token refresh is still being called. I would've liked to call finishWithError in this state but not sure what error to pass.

The error occurs in flutter_appauth: ^0.9.2+6.

Fatal Exception: java.lang.NullPointerException: Attempt to invoke virtual method 'void net.openid.appauth.AuthorizationService.performTokenRequest(net.openid.appauth.TokenRequest, net.openid.appauth.AuthorizationService$TokenResponseCallback)' on a null object reference
       at io.crossingthestreams.flutterappauth.FlutterAppauthPlugin.performTokenRequest(FlutterAppauthPlugin.java:353)
       at io.crossingthestreams.flutterappauth.FlutterAppauthPlugin.access$500(FlutterAppauthPlugin.java:42)
       at io.crossingthestreams.flutterappauth.FlutterAppauthPlugin$4.onFetchConfigurationCompleted(FlutterAppauthPlugin.java:278)
       at net.openid.appauth.AuthorizationServiceConfiguration$ConfigurationRetrievalAsyncTask.onPostExecute(AuthorizationServiceConfiguration.java:364)
       at net.openid.appauth.AuthorizationServiceConfiguration$ConfigurationRetrievalAsyncTask.onPostExecute(AuthorizationServiceConfiguration.java:305)
       at android.os.AsyncTask.finish(AsyncTask.java:755)
       at android.os.AsyncTask.access$900(AsyncTask.java:192)
       at android.os.AsyncTask$InternalHandler.handleMessage(AsyncTask.java:772)
       at android.os.Handler.dispatchMessage(Handler.java:107)
       at android.os.Looper.loop(Looper.java:224)
       at android.app.ActivityThread.main(ActivityThread.java:7590)
       at java.lang.reflect.Method.invoke(Method.java)
       at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:539)
       at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:950)

When another application required for authentication (example: sign & go https://play.google.com/store/apps/details?id=com.ilex.signandgo.android.rescue or https://apps.apple.com / en / app / sign-go-authenticator / id1030806448) is called, it appears above the browser used by flutter_appauth. We therefore lose focus on the browser opened by flutter_appauth and there is no return with access_token even if this one is present ..... because in this case the browser used by appauth remains open if we comes back to it after its passage in background. Would it not be possible to use for the return of access_token a system of messages waiting for the calling application (StreamSubscription / Stream Flutter)? Thank you.

So I was trying to run in Samsung M20 Android 10 Device.

When i call this method : _appAuth.authorizeAndExchangeCode, I get a Webview of my Login screen. But when i tap on my UI (TextField or Submit button) its crashing by closing the webview.

Hello,

I have a problem running my code on android emulator

When i hit auth button that is calling

 final AuthorizationTokenResponse result =
          await appAuth.authorizeAndExchangeCode(
        AuthorizationTokenRequest(
          'xxxxxxxxx',
          'com.okta.dev-xxxxx:/callback',
          discoveryUrl:
              'https://dev-xxx.okta.com/.well-known/openid-configuration',
          scopes: ['openid', 'profile', 'email', 'offline_access'],
        ),
      );

webview opens i can type login and pass but when i hit sign in webview just hangs. and nothing happen.

also when i restart app and want to try again webview opens but it is blank with only URL address above. blank whaite page.

on iOS works like a charm

logs for that

D/NetworkSecurityConfig( 9106): No Network Security Config specified, using platform default
W/ActivityThread( 9106): handleWindowVisibility: no activity for token android.os.BinderProxy@3327a01
D/EGL_emulation( 9106): eglMakeCurrent: 0xe7546bc0: ver 3 0 (tinfo 0xe75f6ff0)
D/EGL_emulation( 9106): eglMakeCurrent: 0xe7546bc0: ver 3 0 (tinfo 0xe75f6ff0)

[√] Flutter (Channel stable, v1.17.2, on Microsoft Windows [Version 10.0.18362.836], locale pl-PL)
    • Flutter version 1.17.2 at C:\src\flutter
    • Framework revision 5f21edf8b6 (2 days ago), 2020-05-28 12:44:12 -0700
    • Engine revision b851c71829
    • Dart version 2.8.3

[√] Android toolchain - develop for Android devices (Android SDK version 29.0.2)
    • Android SDK at C:\Users\Damian\AppData\Local\Android\Sdk
    • Platform android-29, build-tools 29.0.2
    • ANDROID_HOME = C:\Users\Damian\AppData\Local\Android\Sdk
    • Java binary at: C:\Program Files\Android\Android Studio\jre\bin\java
    • Java version OpenJDK Runtime Environment (build 1.8.0_202-release-1483-b03)
    • All Android licenses accepted.

[√] Android Studio (version 3.5)
    • Android Studio at C:\Program Files\Android\Android Studio
    • Flutter plugin version 42.1.1
    • Dart plugin version 191.8593
    • Java version OpenJDK Runtime Environment (build 1.8.0_202-release-1483-b03)

[√] VS Code (version 1.45.1)
    • VS Code at C:\Users\Damian\AppData\Local\Programs\Microsoft VS Code
    • Flutter extension version 3.10.2

[√] VS Code, 64-bit edition (version 1.29.1)
    • VS Code at C:\Program Files\Microsoft VS Code
    • Flutter extension version 3.10.2

[√] Connected device (1 available)
    • Android SDK built for x86 • emulator-5554 • android-x86 • Android 10 (API 29) (emulator)

• No issues found!

I have implemented app_auth and when i am receiving response from Key cloak. Access_token misses few portion which gives response without Payload data. When I modified in flutter_appauth.dart file with performing casting to access_token. I get actual token with Payload data. But it throws some exception "Unhandled Exception: NoSuchMethodError: Class 'String' has no instance method 'cast'." Application got crashed. How should I fix this issue?

Size of token is very long so it does not receive exact portion after "colon(.)". But with casting, it receives and throws an exception.

In the android we can use ConnectionBuilder}that permits connecting to http links, and ignores certificates for https connections. is there any way to use http instead of https. I am getting this error if I am trying to use http

E/AndroidRuntime( 4341): java.lang.RuntimeException: An error occurred while executing doInBackground() E/AndroidRuntime( 4341): at android.os.AsyncTask$3.done(AsyncTask.java:353) E/AndroidRuntime( 4341): at java.util.concurrent.FutureTask.finishCompletion(FutureTask.java:383) E/AndroidRuntime( 4341): at java.util.concurrent.FutureTask.setException(FutureTask.java:252) E/AndroidRuntime( 4341): at java.util.concurrent.FutureTask.run(FutureTask.java:271) E/AndroidRuntime( 4341): at android.os.AsyncTask$SerialExecutor$1.run(AsyncTask.java:245) E/AndroidRuntime( 4341): at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1162) E/AndroidRuntime( 4341): at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:636) E/AndroidRuntime( 4341): at java.lang.Thread.run(Thread.java:764) E/AndroidRuntime( 4341): Caused by: java.lang.IllegalArgumentException: only https connections are permitted And can we use https with self signed certificate

Using version 4.2.0 of flutter_appauth on Samsung Galaxy 7 with OS 12.

To Reproduce:

1. Setup a server that is misconfigured and will return a refresh_token of empty string when responding to the token endpoint.
2. Call appAuth.authorize() followed by appAuth.token() on the server, but surround the call with a try-catch block. Run this on Android.

Result: App shutdown with FATAL EXCEPTION error as follows:

E/AndroidRuntime(17080): java.lang.IllegalArgumentException: refresh token must not be empty if defined E/AndroidRuntime(17080): at net.openid.appauth.Preconditions.checkArgument(Preconditions.java:116) E/AndroidRuntime(17080): at net.openid.appauth.Preconditions.checkNotEmpty(Preconditions.java:68) E/AndroidRuntime(17080): at net.openid.appauth.Preconditions.checkNullOrNotEmpty(Preconditions.java:89) E/AndroidRuntime(17080): at net.openid.appauth.TokenResponse$Builder.setRefreshToken(TokenResponse.java:305) E/AndroidRuntime(17080): at net.openid.appauth.TokenResponse$Builder.fromResponseJson(TokenResponse.java:222) E/AndroidRuntime(17080): at net.openid.appauth.AuthorizationService$TokenRequestTask.onPostExecute(AuthorizationService.java:688) E/AndroidRuntime(17080): at net.openid.appauth.AuthorizationService$TokenRequestTask.onPostExecute(AuthorizationService.java:579) E/AndroidRuntime(17080): at android.os.AsyncTask.finish(AsyncTask.java:771) E/AndroidRuntime(17080): at android.os.AsyncTask.access$900(AsyncTask.java:199) E/AndroidRuntime(17080): at android.os.AsyncTask$InternalHandler.handleMessage(AsyncTask.java:788) E/AndroidRuntime(17080): at android.os.Handler.dispatchMessage(Handler.java:106) E/AndroidRuntime(17080): at android.os.Looper.loopOnce(Looper.java:226) E/AndroidRuntime(17080): at android.os.Looper.loop(Looper.java:313) E/AndroidRuntime(17080): at android.app.ActivityThread.main(ActivityThread.java:8751) E/AndroidRuntime(17080): at java.lang.reflect.Method.invoke(Native Method) E/AndroidRuntime(17080): at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:571) E/AndroidRuntime(17080): at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1135) I/Process (17080): Sending signal. PID: 17080 SIG: 9

Expected: Catch block to be entered.

In other words, server errors should not cause the app to crash.

An implementation for the issue https://github.com/MaikuB/flutter_appauth/issues/394

It employs a new code format: <existing code>:<domain/type>:<code>

This might need to be considered as Breaking Changes, as it breaks the code that checks code right now. But it can be easily fixed:

For existing code:

try { 
  // calling appauth
} on PlatformException catch(ex) {
  if (ex.code == "authorize_and_exchange_code_failed") {
    // handle error
  }
}

It can be upgraded as

try { 
  // calling appauth
} on PlatformException catch(ex) {
  if (ex.code.startsWith("authorize_and_exchange_code_failed:")) {
    // handle error
  }
}

For user cancelled the webview for auth, the error could be

• iOS: authorize_and_exchange_code_failed:org.openid.appauth.general:-3
• Android: authorize_and_exchange_code_failed:GENERAL_ERROR:1

Problem

Currently, when AppAuth failed, the plugin throws PlatformException. The code of PlatformException is hardcoded to a certain value based on which method the app called, which isn't very useful. As the app should have know which API is called. Instead the actual useful information isn't passed up.

For example, if app calls authorizeAndExchangeCode, and then user canceled the web view popped up.

On iOS:

PlatformException(authorize_and_exchange_code_failed, Failed to authorize: The operation couldn’t be completed. (org.openid.appauth.general error -3.), null, null)

The code authorize_and_exchange_code_failed is useless as we have known we called authorizeAndExchangeCode.

The useful bit is actually org.openid.appauth.general and -3, which is the code and domain of the NSError underneath, but it is mixed in the message that passed up.

on Android:

Error: PlatformException(authorize_and_exchange_code_failed, Failed to authorize: [error: null, description: User cancelled flow], null, null)

Again authorize_and_exchange_code_failed is not helpful. User cancelled flow is the one useful. And we missed some extra information here.

Proposal

When throw PlatformException from plugin, rather than returns hard coded thing that bind to the calling method. Expose the more detail from underneath error.

For iOS: Use the concat the NSError's domain and code as the PlatformException error code. So it would return org.openid.appauth.general -3 instead of authorize_and_exchange_code_failed as code.

And for Android: The AppAuth would throws AuthorizationException, which contains type and code. return the type and code accordingly.

getting following error when using flutter_appauth plugin MissingPluginException(No implementation found for method authorizeAndExchangeCode on channel crossingthestreams.io/flutter_appauth) flutter_appauth: ^4.2.1 Flutter version 3.3.9 similar to this issue https://github.com/MaikuB/flutter_appauth/issues/66

Greetings,

I am experiencing a crash on Android when I try to make the authorizeAndExchangeCode call.

flutter_appauth: ^4.2.1 Flutter 3.3.8

D/AndroidRuntime( 8811): Shutting down VM
E/AndroidRuntime( 8811): FATAL EXCEPTION: main
E/AndroidRuntime( 8811): Process: com.renoon.fashion, PID: 8811
E/AndroidRuntime( 8811): java.lang.NullPointerException: Attempt to invoke virtual method 'boolean java.lang.String.equals(java.lang.Object)' on a null object reference
E/AndroidRuntime( 8811): 	at net.openid.appauth.IdToken.validate(IdToken.java:232)
E/AndroidRuntime( 8811): 	at net.openid.appauth.AuthorizationService$TokenRequestTask.onPostExecute(AuthorizationService.java:710)
E/AndroidRuntime( 8811): 	at net.openid.appauth.AuthorizationService$TokenRequestTask.onPostExecute(AuthorizationService.java:579)
E/AndroidRuntime( 8811): 	at android.os.AsyncTask.finish(AsyncTask.java:771)
E/AndroidRuntime( 8811): 	at android.os.AsyncTask.access$900(AsyncTask.java:199)
E/AndroidRuntime( 8811): 	at android.os.AsyncTask$InternalHandler.handleMessage(AsyncTask.java:788)
E/AndroidRuntime( 8811): 	at android.os.Handler.dispatchMessage(Handler.java:106)
E/AndroidRuntime( 8811): 	at android.os.Looper.loop(Looper.java:223)
E/AndroidRuntime( 8811): 	at android.app.ActivityThread.main(ActivityThread.java:7656)
E/AndroidRuntime( 8811): 	at java.lang.reflect.Method.invoke(Native Method)
E/AndroidRuntime( 8811): 	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:592)
E/AndroidRuntime( 8811): 	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:947)
I/Process ( 8811): Sending signal. PID: 8811 SIG: 9
Lost connection to device.

Could you help me identify the problem?

Thanks in advance