refactor: refactor SDK using flutter_web_auth_2 #76
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Refactor @logto/dart SDK using the new flutter_web_auth_2 library.
Context
This PR refactors the Logto Dart SDK using the new flutter_web_auth_2 package to handle the OAuth2 user authorization flow.
The SDK originally used the flutter_web_auth package to handle the OAuth2 user authorization flow. However, this outdated package is no longer maintained. We have received multiple reported issues with the package, which does not work properly with some of the latest platforms and devices. Hence, we refactor the SDK to use the new flutter_web_auth_2 package.
Updates
These updates will not affect the SDK API and user experiences. Major fixes and improvements are:
preferEphemeral
parameter does not work on Android. Even with theephemeralIntentFlags
specified, the webview still preserves the Logto sign-in session on Android. As a workaround, for Android and Web platforms, redirect the user to theend_session_endpoint
to clear the sign-in session after the user signs out manually.Breaking change
logtoClient.signOut
method now requires aredirectUri
parameter. For iOS platform, this parameter is useless, but for Android and Web platforms which require an additionalend_session
request to clean up the sign-in session, this parameter will be used as thepost_logout_redirect_uri
parameter in theend_session
request.Testing
Test locally using iOS, Android, and Chrome simulators.
Checklist
.changeset