Missing WebView events: Navigating / Navigated / ReloadRequested

I’m trying to use a WebView for OIDC sign in. After logging in, the identity service redirects to another URL. In non-Blazor apps, I’d subscribe to the WebView.Navigating event to handle the redirect and read authorization codes or tokens.

However, these events appear to be missing in the WebView provided by MobileBlazorBindings. Is there a way to subscribe to this event currently?

Version I’m using: 0.5.50-preview

[jspuij]

Hi @cornem. The Navigating and Navigated events are indeed not exposed ATM. We will expose them in the future. A few things need to happen for that:

1. The events need to be exposed on the (Blazor) Webview component. (Your code above).
2. The renderers need to be fixed to actually trigger the events. ATM only the Android renderer will properly trigger the Navigating and Navigated events. This is because the Android renderer is based on the original Xamarin Renderer, whereas the Windows, iOS and macOS renderers were written from scratch and this was not taken into account. The native events are just not wired to the platform independent encapsulating Xamarin webview. It’s on my todo list to fix this.

However using a webview for auth is discouraged on iOS, macOS and Android. The webview does not show an URL and the users cannot inspect the certificate easily, opening the door to MITM attacks. That is why on iOS and macOS and Android steps were taken to block this. E.g. on mobile platforms redirecting to a custom scheme in a normal webview isn’t allowed anymore. Likewise Google servers detect an embedded webview and will block auth based on the User agent. I would not use a webview a.t.m. for auth.

https://www.gluu.org/blog/webviews-are-bad-use-appauth/ https://www.oauth.com/oauth2-servers/oauth-native-apps/use-system-browser/

What we will add in the next preview (possible in the nightlies already in a week or so) is add Auth to MBB based on the OS intrinsic mechanisms of the platform. Xamarin Essentials exposes these as WebAuthenticator for iOS, macOS and Android. We will write our own version for windows.

The advantage of using a platform secure webview or custom tabs is that extensions are allowed to run (so password managers work), whereas in a normal webview they won’t.

You can find some early preview videos here:

https://youtu.be/-mqT1uOVmco https://youtu.be/X4PwEf3VC3g https://youtu.be/S_ppoP-LftE

Unfortunately the logout experience is poor on iOS and macOS. There is an additional popup requesting login, when you actually logout. This can be prevented by using a private browsing session (not sharing cookies with the main browser), but unfortunately Xamarin essentials does not expose that parameter. We will ask the Xamarin team to add this feature.

[jspuij]

I have an initial implementation of Auth in #215. It’s just not finished yet, but will take a week or two more. Then it will be part of MBB.