Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Non-HTTPS URL redirect is not supported in a web view (android microsoft identity client msal) #25856

Open
Swodah opened this issue Nov 14, 2024 · 0 comments
Labels
t/bug Something isn't working

Comments

@Swodah
Copy link

Swodah commented Nov 14, 2024

Description

I have also described the issue in the MSAL github but it may be a maui - android issue more than a library issue so I am asking for help here as well.
Link to the issue on the microsoft authentication library for dotnet github

AzureAD/microsoft-authentication-library-for-dotnet#4994

Short description:
When I open A broker with azure B2C_1A authentication and it redirects to the national authentication which then redirects to an app for verification.
The problem lies in the step where the national authentication redirects to the "MitID app" with
intent://appswitchmitid.page.link/?link=https://appswitch.mitid.dk?ticket"ticketid"returnUrl%3DChrome&apn=dk.mitid.app.android&afl=https://appswitch.mitid.dk#Intent;package=com.google.android.gms;action=com.google.firebase.dynamiclinks.VIEW_DYNAMIC_LINK;scheme=https;S.browser_fallback_url=https://appswitch.mitid.dk;end;

I get the following error:

Microsoft.Identity.Client.MsalServiceException: Non-HTTPS URL redirect is not supported in a web view. This error happens when the authorization flow, which collects user credentials, gets redirected to a page that is not supported, for example if the redirect occurs over http. This error does not trigger for the final redirect, which can be http://localhost, but for intermediary redirects.Mitigation: This usually happens when using a federated directory which is not setup correctly.

I have tried various workaround but couldn't get it to accept the redirect (look at the linked issue to see in depth on my workaround attempts).

I hope someone knows a workaround to either the embedded webview or if it is a bug that can be fixed.

Steps to Reproduce

No sure how to make a reproduction project as you'd need a danish MitID connected to one of the testusers we have and all the clientid's/secrets that most likely shouldn't be public.

Link to public reproduction project repository

No response

Version with bug

9.0.0 GA

Is this a regression from previous behavior?

Not sure, did not test other versions

Last version that worked well

Unknown/Other

Affected platforms

Android

Affected platform versions

android 14 (34)

Did you find any workaround?

No response

Relevant log output

@Swodah Swodah added the t/bug Something isn't working label Nov 14, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
t/bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant