Re: [keycloak-dev] [keycloak-user] Best practices for securing sign-in on mobile

The Google Identity team just open sourced some Open ID Connect libraries that use In-app tabs on Android and SFSafariViewController on iOS for secure, streamlined web workflows in-app. https://openid.github.io/AppAuth-Android https://openid.github.io/AppAuth-iOS -Jason From: <keycloak-user-bounces(a)lists.jboss.org&gt; on behalf of Stian Thorgersen <sthorger(a)redhat.com&gt; Reply-To: &quot;stian(a)redhat.com&quot; <stian(a)redhat.com&gt; Date: Monday, March 7, 2016 at 12:11 AM To: keycloak-dev <keycloak-dev(a)lists.jboss.org&gt;, " keycloak-user(a)lists.jboss.org&quot; <keycloak-user(a)lists.jboss.org&gt; Subject: [keycloak-user] Best practices for securing sign-in on mobile Our Cordova apapter uses a webview (via cordova-plugin-inappbrowser) to open the login page. This results in no SSO between applications and it also has some security implications. A better approach is to use in app browser tabs when supported or fallback to the system browser. See https://www.youtube.com/watch?v=ppeU8yeI_ks for more details.