Skip to content

Commit 314f8c9

Browse files
committed
Add host and path comparator to webview implementation
Fixes #146
1 parent d26b1db commit 314f8c9

2 files changed

Lines changed: 26 additions & 13 deletions

File tree

flutter_web_auth_2/lib/src/options.dart

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ class FlutterWebAuth2Options {
8282
customTabsPackageOrder: json['customTabsPackageOrder'],
8383
);
8484

85-
/// **Only has an effect on iOS and MacOS!**
85+
/// **Only has an effect on iOS and macOS!**
8686
/// If this is `true`, an ephemeral web browser session
8787
/// will be used where possible (`prefersEphemeralWebBrowserSession`).
8888
/// For Android devices, see [intentFlags].
@@ -111,7 +111,7 @@ class FlutterWebAuth2Options {
111111
/// possible parameter values.
112112
final String? windowName;
113113

114-
/// **Only has an effect on Linux, Web and Windows!**
114+
/// **Only has an effect on Linux, Web, and Windows!**
115115
/// Can be used to specify a timeout in seconds when the authentication shall
116116
/// be deemed unsuccessful. An error will be thrown in order to abort the
117117
/// authentication process.
@@ -143,18 +143,22 @@ class FlutterWebAuth2Options {
143143
/// described in https://github.com/ThexXTURBOXx/flutter_web_auth_2/issues/25
144144
final bool useWebview;
145145

146-
/// **Only has an effect on iOS and MacOS!**
146+
/// **Only has an effect on iOS, Linux, macOS, and Windows!**
147147
/// String specifying the **host** of the URL that the page will redirect to
148148
/// upon successful authentication (callback URL).
149149
/// When `callbackUrlScheme` is `https`, this **must** be specified on
150150
/// Apple devices running iOS >= 17.4 or macOS >= 14.4.
151+
/// On Linux and Windows, this is used when `useWebview == true` in order to
152+
/// compare with the host of the callback URL (no matter which scheme!).
151153
final String? httpsHost;
152154

153-
/// **Only has an effect on iOS and MacOS!**
155+
/// **Only has an effect on iOS, Linux, macOS, and Windows!**
154156
/// String specifying the **path** of the URL that the page will redirect to
155157
/// upon successful authentication (callback URL).
156158
/// When `callbackUrlScheme` is `https`, this **must** be specified on
157159
/// Apple devices running iOS >= 17.4 or macOS >= 14.4.
160+
/// On Linux and Windows, this is used when `useWebview == true` in order to
161+
/// compare with the path of the callback URL (no matter which scheme!).
158162
final String? httpsPath;
159163

160164
/// **Only has an effect on Android!**

flutter_web_auth_2/lib/src/webview.dart

Lines changed: 18 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ import 'dart:async';
22

33
import 'package:desktop_webview_window/desktop_webview_window.dart';
44
import 'package:flutter/services.dart';
5+
import 'package:flutter_web_auth_2/flutter_web_auth_2.dart';
56
import 'package:flutter_web_auth_2_platform_interface/flutter_web_auth_2_platform_interface.dart';
67
import 'package:path_provider/path_provider.dart';
78

@@ -21,6 +22,9 @@ class FlutterWebAuth2WebViewPlugin extends FlutterWebAuth2Platform {
2122
// Microsoft's WebView2 must be installed for this to work
2223
throw StateError('Webview is not available');
2324
}
25+
26+
final parsedOptions = FlutterWebAuth2Options.fromJson(options);
27+
2428
// Reset
2529
_authenticated = false;
2630
_webview?.close();
@@ -37,16 +41,21 @@ class FlutterWebAuth2WebViewPlugin extends FlutterWebAuth2Platform {
3741
);
3842
_webview!.addOnUrlRequestCallback((url) {
3943
final uri = Uri.parse(url);
40-
if (uri.scheme == callbackUrlScheme) {
41-
_authenticated = true;
42-
_webview?.close();
43-
/**
44-
* Not setting the webview to null will cause a crash if the
45-
* application tries to open another webview
46-
*/
47-
_webview = null;
48-
c.complete(url);
44+
if (uri.scheme != callbackUrlScheme ||
45+
(parsedOptions.httpsHost != null &&
46+
uri.host != parsedOptions.httpsHost) ||
47+
(parsedOptions.httpsPath != null &&
48+
uri.path != parsedOptions.httpsPath)) {
49+
return;
4950
}
51+
_authenticated = true;
52+
_webview?.close();
53+
/**
54+
* Not setting the webview to null will cause a crash if the
55+
* application tries to open another webview
56+
*/
57+
_webview = null;
58+
c.complete(url);
5059
});
5160
unawaited(
5261
_webview!.onClose.whenComplete(

0 commit comments

Comments
 (0)