This demo shows how you can automatically log in users to your iOS app after they install it based on cookies previously set in Safari. The idea is that if you have a way of logging them in somewhere in the browser before they download your app, or they have previously logged in to your webapp before installing it, you can automatically recognize them without them having to go through an in-app login flow and enter the same login info again.
This project was inspired by this article by LaunchKit.
== UPDATE 2017 ==
The original approach doesn't work anymore - some people of course had to use it for evil purposes (surprise surprise) and Apple has changed a few things:
-
the App Store Review Guidelines (5.1.1) now specifically say that:
SafariViewContoller must be used to visibly present information to users; the controller may not be hidden or obscured by other views or layers. Additionally, an app may not use SafariViewController to track users without their knowledge and consent.
-
since iOS 10, SafariViewController doesn't seem to load at all when alpha is set to 0
-
since iOS 11, SafariViewController uses a separate cookie storage from Safari, so even if you manage to make it load, it won't recognize you
Possible alternatives:
- Shared Web Credentials (if the user uses iCloud Keychain)
- SFAuthenticationSession, a new API added in iOS 11 beta 3 (also supports e.g. 1Password, but loses some of the "magic" of automatically recognizing the user)
- one popular third party service that uses fingerprinting and other shady techniques, but please don't use that ๐
I've added support for SFAuthenticationSession
in the app - you can launch it by tapping the "Authenticate" button. It's actually pretty nice and the result is very similar to the old approach, except you get a popup first where you have to confirm access and then you see the SVC slide up and down.
Here's how it looks:
It's actually pretty simple:
- the app creates an
SFSafariViewController
at startup and tells it to load a special page in your webapp that automatically redirects back to your app using a custom URL scheme (you can only pass something back to your app with a redirect, since the app has no direct access to the contents of the Safari View Controller) - the main view controller presents the Safari View Controller as a popup (it needs to be displayed to start loading the page), but to hide the Safari View Controller from the user, it sets its
modalPresentationStyle
to.OverCurrentContext
and its view'salpha
to 0- update: alpha now needs to be at least 0.05
- you might also be able to get it to work with a second UIWindow
- the page reads the name from the previously set cookie and redirects to
svclogintest://name/yournamehere
; that triggers the callbackapplication(handleOpenURL:)
in the application delegate, which notifies the view controller about it through anNSNotification
- you could also use universal app links for this, which would avoid a possible issue with some other app using the same URL scheme as yours, accidentally or on purpose
- when the page finishes loading, the view controller automatically cleans up the SVC
- when the view controller receives the notification from the delegate, it updates the label in the center with the user's name
So this way you can remember the user between app installations and even before it's installed for the first time, as long as you control the site which sets the cookies and can make it redirect to the custom URL, and as long as the user doesn't clear the cookies in Safari. (I've seen an issue though where even after clearing the cookies the SVC was still seeing them, even though Safari didn't - might be a bug in the beta?)
For the new 2017 version using SFAuthenticationSession
:
- the app creates an
SFAuthenticationSession
and saves it in an instance variable (otherwise the popup disappears immediately) - it tells is to load exactly the same URL as in SVC and launches it by calling
start()
- anyone knows how to change the "(null)" in the message that's shown in the popup? or what the
callbackURLScheme
is for, since it seems to work just fine regardless what you put there?
- anyone knows how to change the "(null)" in the message that's shown in the popup? or what the
- if authentication succeeds, you get a URL which you can handle the same way as in
application(handleOpenURL:)
, if not, you get an error object
-
download or clone the project
-
in a terminal, go into the project's directory and start an HTTP server in that folder:
python -m SimpleHTTPServer
-
open the project in Xcode 7
-
build & run
-
to log in & out, go to
http://localhost:8000
in Safari in the simulator and use the form to update the name
Created by Kuba Suder, licensed under WTFPL license.
If you have any suggestions or comments, please let me know via Twitter @kuba_suder, email or GitHub issues.
Note: please don't use this for any evil purposes ๐