mobile origin url

[harish_reddy]

Hi

I am trying to add android-app://com.example
as
Authorized request origin URL
in application's OAuth settings

It is rejecting the value with error URL must start with http

Is this a bug?

[joshua]

@harish_reddy

Is this still an open item of concern for you? I can review it further if need be.

If you believe it to be a bug you can also log a bug request
(https://github.com/FusionAuth/fusionauth-issues/issues/new/choose)

Thanks,
Josh

[harish_reddy]

@joshua

Done

https://github.com/FusionAuth/fusionauth-issues/issues/1443

[dan]

Thanks for filing this.

Can you provide a few more details (on the bug or here) to talk about why you need to set the origin URL in your mobile app?

Typically you need to set the Authorized redirect URL, but this tutorial, for example, doesn't set the origin URL: https://fusionauth.io/blog/2020/08/19/securing-react-native-with-oauth/

From https://fusionauth.io/docs/v1/tech/core-concepts/applications/

This optional configuration allows you to restrict the origin of an OAuth2 / OpenID Connect grant request. If no origins are registered for this Application, all origins are allowed.

By default FusionAuth will add the X-Frame-Options: DENY HTTP response header to the login pages to keep these pages from being rendered in an iframe. If the request comes from an authorized origin, however, FusionAuth will not add this header to the response. To load FusionAuth hosted login pages in an iframe, you will need to add the request origin to this configuration

[harish_reddy]

Authorised redirect URL config has no issues.

I added "https://example.com" as authorise origin url for security. Then I noticed traffic from android app is getting blocked with

"android-app://com.example" is not authorised origin

[dan]

Where are you seeing that error message? Can you please provide repro steps?

Thanks!

[harish_reddy]

I provided steps to reproduce in the github issue : https://github.com/FusionAuth/fusionauth-issues/issues/1443

[dan]

@harish_reddy

Thanks, I saw the steps to reproduce in the administrative user interface.

I am sorry for being unclear. I was looking for steps to reproduce in the android application.

In particular, I'm unsure where/how you are seeing this behavior:

Then I noticed traffic from android app is getting blocked with

It sounds like:

• you have an application in FusionAuth.
• It was working fine with both a mobile app and a web application
• You then added https://example.com to the application config's authorized origin URL.
• The web application continues to work fine
• The android application now has issues

Is that correct? Or am I missing something?

If it is correct, I want to know more about those issues.

Are you:

• getting error messages
• being prevented from logging in using the android app
• some other behavior

Also, is the android app a webview of the hosted login pages?

Thanks.

[harish_reddy]

Yes, that's correct.

In android app, we are using oidc react-native library.
The screen gets stuck after clicking login button.
Expected : Open fusionauth login page in in-app browser
Actual:
There is an error message
[Error: Invalid origin uri android-app://com.example/]

[dan]

Hi @harish_reddy ,

I didn't want this to get lost (I don't check the forum every day) so asked our support team to open a ticket.

Thanks!

[alickabrook1]

Can you provide a few more details (on the bug or here) to talk about why you need to set the origin URL in your mobile app?

[alickabrook1]

@alickabrook1 said in mobile origin url:

Can you provide a few more details (on the bug or here) to talk about why you need to set the origin URL in your mobile app?

I didn't want this to get lost (I don't check the forum every day) so asked our support team to open a ticket.

[harish_reddy]

@alickabrook1
I was not setting origin URL in mobile app.

I was setting it in fusionauth config.

Shared screenshot in https://github.com/FusionAuth/fusionauth-issues/issues/1443