-
Task
-
Resolution: Fixed
-
Normal
-
None
-
None
The Register Application page provides only 2 options: 1) Web application 2) Installed application.
Mobile applications are installed applications but differ in client side OAuth2.0 approach. Mobile OS (Android & iOS) provide a feature called custom uri scheme to allow redirecting the authorization code directly to the required mobile app.
The current offered option cannot handle this use case because:
1) Web applications allow to specify a callback url only with http or https as the host which is completely reasonable.
2) Installed applications do not allow specification of callback url.
The out of band approach can still be used but it hampers UX which is one of the deciding factors in usage of an app. Almost all REST APIs allow this custom uri schemes as a de facto standard.
The installed application option should be allowed to set redirect URI just the same as web application with the exception that the callback URL should use custom scheme as in org.example.app://auth that can be registered and reached on mobile platforms.
As a part of the task, it is also required to add the necessary changes to website UI and documentation.