If you want a callback URL that starts with https, you must use the .https(...) callback type, which is only available on iOS 17.4 and later. Prior to this, ASWebAuthenticationSession required the use of a custom scheme (i.e. a scheme that's not http/https). For example, your callback URL in that case might look like myapp://auth/callback. Some services may warn against using custom schemes, as they may have security difficulties on some platforms. This is because, unlike https callbacks, any app could claim the myapp:// scheme, potentially resulting in your auth callback going to the wrong app. However, ASWebAuthenticationSession was specifically built to mitigate this concern, ensuring only your app will receive callbacks for that scheme when it's opened via ASWebAuthenticationSession.
Topic:
Privacy & Security
SubTopic:
General
Tags: