We have an iOS app built with React + Capacitor that uses @capgo/capacitor-inappbrowser for Apple/Google social login.
The iOS flow uses ASWebAuthenticationSession.
Our backend/auth provider is Base44. Base44 supports web OAuth, but they have confirmed they do not provide a supported native authorization-code / PKCE session exchange for externally wrapped Capacitor apps.
Current flow:
The app starts Base44 OAuth in ASWebAuthenticationSession.
Base44 completes Apple or Google authentication.
Base44 redirects to an HTTPS bridge page hosted on our Base44 app domain.
The bridge receives the Base44 access token.
The bridge redirects to our app callback URL scheme and includes that Base44 bearer token in the callback.
The active ASWebAuthenticationSession receives the callback.
The app validates the callback URL, verifies a one-time random state, sets the Base44 token and immediately calls auth.me() to confirm the authenticated account.
We have already hardened the flow by:
using a 256-bit random one-time state
expiring pending login attempts after 10 minutes
binding the state to the provider and locally stored return path
validating callback scheme/host/path
removing unsolicited/global deep-link authentication listeners
using prefersEphemeralWebBrowserSession = true
scrubbing token artifacts from the hosted bridge URL/local storage
not trusting callback-supplied return paths
verifying the Base44 account before marking native login complete
We understand that the preferred native OAuth model is authorization code + PKCE, but the backend provider does not expose that capability for this integration.
My question is:
Given that ASWebAuthenticationSession delivers the authentication callback to the initiating session, is passing a reusable backend bearer token through that callback still considered unsuitable for a production iOS app?
If it is unsuitable, is there any secure pattern available when the authentication provider does not support a native one-time code / PKCE exchange?
We also need to preserve existing Apple/Google-linked Base44 accounts, user data and subscription entitlements, so replacing the authentication backend is not a simple migration.
I would particularly appreciate guidance on whether:
ASWebAuthenticationSession materially mitigates custom-scheme interception in this scenario
changing to a Universal Link callback would materially improve the design if the bearer token still has to be transferred
this architecture would be considered acceptable for an App Store production release