Research: Embedded Web Sign-in

[kuruk-mm]

Objective

Sign-in is integrated into the App. The only change is when using Wallet Connect for authentication and signing with the Wallet Connect app.

Android

The solutions for Android involve using either WebKit or Chrome Custom Tabs (androidx.browser:browser).

WebKit

Social Login

After testing with WebKit, I found some issues with social login. We need to authorize the servers to allow the use of WebKit by adding "org.decentraland.godotexplorer" to the allow list. Additionally, cookies and credentials are not shared, so users must log in with their credentials specifically for WebKit.

Wallet Connect Login

Wallet Connect login works perfectly with WebKit. There were some issues with the response from MetaMask, which could be a provider issue. Trust Wallet works great, though switching between "DCLExplorer ↔ Trust Wallet" multiple times can be a bit annoying. This behavior is similar across all dApps.

Chrome Custom Tabs

Social Login

Chrome Custom Tabs resolve almost all issues with social login. There is no need to authorize the app server-side, as Chrome handles it and inherits all security aspects, including cookies and credentials. As a result, Google authentication works seamlessly.

The main issue is with app control. When the Chrome Custom Tab is opened, we lose control in the app, preventing any code execution. We can address this by adding deep-link registration and modifying the front end to call this deep link once authentication is complete.

Wallet Connect Login

I tested Wallet Connect with Chrome Custom Tabs, and it appears to work worse than WebKit. When switching apps, the Chrome Custom Tab closes, and I haven't found a way to prevent this. Further research may be required.

Fallback for Chrome

If Chrome is not installed, we can fallback to another Webbrowser like Firefox using the following flags:

val builder = CustomTabsIntent.Builder()
val customTabsIntent = builder.build()
customTabsIntent.intent.addFlags(Intent.FLAG_ACTIVITY_NO_HISTORY)
customTabsIntent.intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TOP)
customTabsIntent.intent.setPackage("org.mozilla.firefox")
customTabsIntent.launchUrl(activity, Uri.parse(url))

Proposal

Use a combination of WebKit for Trust Wallet and Chrome Custom Tabs for social login. In the Godot app, add a button for "Social Login" (covering all social login options, excluding Wallet Connect) and another for "Wallet Connect" (skipping the app selection menu).

Additionally, we need to modify the frontend to execute a deep link upon authentication completion.

iOS

Work in Progress (WIP)