diff --git a/src/ActiveLogin.Authentication.BankId.AspNetCore/Client/activelogin-main.ts b/src/ActiveLogin.Authentication.BankId.AspNetCore/Client/activelogin-main.ts index 9353f876..9487ea8e 100644 --- a/src/ActiveLogin.Authentication.BankId.AspNetCore/Client/activelogin-main.ts +++ b/src/ActiveLogin.Authentication.BankId.AspNetCore/Client/activelogin-main.ts @@ -109,6 +109,15 @@ function activeloginInit(configuration: IBankIdUiScriptConfiguration, initState: var flowIsCancelledByUser = false; var flowIsFinished = false; + function launchBankIdApp(url: string) { + // Use BankID recommended approach for launching the app + // See: https://developers.bankid.com/getting-started/autostart + const link = document.createElement("a"); + link.href = url; + link.referrerPolicy = "origin"; + link.click(); + } + function enableCancelButton(requestVerificationToken: string, cancelUrl: string, orderRef: string = null) { var onCancelButtonClick = (event: Event) => { cancel(requestVerificationToken, cancelUrl, orderRef); @@ -132,7 +141,7 @@ function activeloginInit(configuration: IBankIdUiScriptConfiguration, initState: if (data.deviceMightRequireUserInteractionToLaunchBankIdApp) { var startBankIdAppButtonOnClick = (event: Event) => { - window.location.href = data.redirectUri; + launchBankIdApp(data.redirectUri); hide(startBankIdAppButtonElement); event.target.removeEventListener("click", startBankIdAppButtonOnClick); }; @@ -140,7 +149,7 @@ function activeloginInit(configuration: IBankIdUiScriptConfiguration, initState: show(startBankIdAppButtonElement); } else { - window.location.href = data.redirectUri; + launchBankIdApp(data.redirectUri); } } diff --git a/src/ActiveLogin.Authentication.BankId.Core/Launcher/BankIdLauncher.cs b/src/ActiveLogin.Authentication.BankId.Core/Launcher/BankIdLauncher.cs index 6e1c6075..f7b2c866 100644 --- a/src/ActiveLogin.Authentication.BankId.Core/Launcher/BankIdLauncher.cs +++ b/src/ActiveLogin.Authentication.BankId.Core/Launcher/BankIdLauncher.cs @@ -47,20 +47,16 @@ public async Task GetLaunchInfoAsync(LaunchUrlRequest request) private bool GetDeviceMightRequireUserInteractionToLaunchBankIdApp(BankIdSupportedDevice detectedDevice, BankIdLauncherCustomBrowserConfig? customBrowserConfig) { var userInteractionBehaviour = customBrowserConfig?.BrowserMightRequireUserInteractionToLaunch ?? BrowserMightRequireUserInteractionToLaunch.Default; - + return userInteractionBehaviour switch { BrowserMightRequireUserInteractionToLaunch.Always => true, BrowserMightRequireUserInteractionToLaunch.Never => false, - // On Android, some browsers will (for security reasons) not launching a - // third party app/scheme (BankID) if there is no user interaction. - // - // - Chrome, Edge, Samsung Internet Browser and Brave is confirmed to require User Interaction - // - Firefox and Opera is confirmed to work without User Interaction - _ => detectedDevice.DeviceOs == BankIdSupportedDeviceOs.Android - && detectedDevice.DeviceBrowser != BankIdSupportedDeviceBrowser.Firefox - && detectedDevice.DeviceBrowser != BankIdSupportedDeviceBrowser.Opera + // Modern recommendation from BankID -> on mobile show fallback button + // Ref: https://developers.bankid.com/resources/ui-guide-mobile + _ => (detectedDevice.DeviceOs == BankIdSupportedDeviceOs.Ios + || detectedDevice.DeviceOs == BankIdSupportedDeviceOs.Android) }; } @@ -99,20 +95,10 @@ private string GetPrefixPart(BankIdSupportedDevice device) private static bool CanUseAppLink(BankIdSupportedDevice device) { - // Only Safari on IOS and Chrome or Edge on Android version >= 6 seems to support - // the https://app.bankid.com/ launch url + // Universal Links (https://app.bankid.com/) are the recommended approach for mobile devices + // per BankID documentation: https://developers.bankid.com/getting-started/autostart - return device is - { - DeviceOs: BankIdSupportedDeviceOs.Ios, - DeviceBrowser: BankIdSupportedDeviceBrowser.Safari - } - or - { - DeviceOs: BankIdSupportedDeviceOs.Android, - DeviceOsVersion.MajorVersion: >= 6, - DeviceBrowser: BankIdSupportedDeviceBrowser.Chrome or BankIdSupportedDeviceBrowser.Edge - }; + return device.DeviceOs == BankIdSupportedDeviceOs.Ios || device.DeviceOs == BankIdSupportedDeviceOs.Android; } private string GetQueryStringPart(BankIdSupportedDevice device, LaunchUrlRequest request, BankIdLauncherCustomBrowserConfig? customBrowserConfig)