React-native-auth0: Passwordless without webAuth

[nenti]

Dear auth0 team, I would like to implement passwordless request out of my react-native ui and don't want to use webauth. Is there a workaround to implement own UI and not break native app experience with this react-native library?

Is it possible to use auth0.js for react native application to use the passwordless request?

[lbalmaceda]

Is there a workaround to implement own UI and not break native app experience with this react-native library?

No, Passwordless can only be achieved through the Universal Login Page. You can read in that same page why web auth is the recommended way.

Is it possible to use auth0.js for react native application to use the passwordless request?

I don't really know, you'll have to try. As long as you perform a code exchange with PKCE you should be safe.

May I ask why you don't want to show the browser, besides having to leave your "native" app? this is a standard nowadays and users trust more on a well-known app such as their browser than an embedded webview or api call happening within an unknown app.

[nenti]

Leaving the native app is a big thing for us. We are developing a commerce app that already has optimized native login flow for best conversion in checkout flow. Also since I am migrating from aws-cognito, I have everything that is required to manage token and refresh in the app so I don't want to throw away our loginflow to go to a standard webauth.

I think I found a way to do it by the way:

1. Implement a passwordless request code endpoint with node-auth0 in your backend to request a auth code for a passed in email.
2. Call password realm from this library directly from the react-native endpoint with the entered auth code.

I seriously don't understand why you don't offer passwordless request directly out of the native library. Bottom line it's just a REST request that we need to handle with a workaround as of now.

[luisrudge]

That's not specific to this project. As of now, our backend only supports doing Passwordless authentication via a web browser, so you won't find any other native or backend SDK that support that scenario. Calling oauth/token might work for now, but it's not a supported scenario and has a few limitations because it doesn't create a session at Auth0's servers, so there's no SSO support etc.

[luisrudge]

Just to add more context: we're aware of the limitations and we know it's not the ideal solution for everyone. We have plans to offer Passwordless via API in the future, but there is no ETA as of now.

[santthosh]

This is one thing that put me off really bad, I'm walking away from Auth0 just because I'll have open a browser window and that I have no control on the token expiry, 2 hours force user to login?!.

For anyone why tries the approach proposed by @nenti they don't let you do that anymore, you will run into the error Passwordless authentication is not allowed on this endpoint.

[Alexander-0x80]

This is very disappointing indeed.

[bartolkaruza]

You can implement the first step in the Passwordless flow by making a post request based on the user provided email: https://auth0.com/docs/api-auth/passwordless

Also the webAuth of the JS SDK provides a method to implement this called passwordLessStart which is easy to port. @luisrudge are you open for a PR to port this to react-native-auth0?

[bartolkaruza]

Well here it is anyway :)
https://github.com/auth0/react-native-auth0/pull/189

[bmovement]

This is one thing that put me off really bad, I'm walking away from Auth0 just because I'll have open a browser window and that I have no control on the token expiry, 2 hours force user to login?!.

@santthosh Did you find a different provider you'd recommend?

[estsauver]

Just thought I'd chime in: We operate in the field in subsaharan Africa. We currently use digits which has a version that works quite well natively. We'd love to migrate to Auth0 but this is blocking the final step of the migration, opening up chrome in the phones we typically are working with puts meaningful memory pressure on the device.

[kodayashi]

I'm surprised this isn't supported by Auth0. Authentication should be seamless for users and opening up web views disturbs the user experience. The branding options for the hosted views are weak as well (link to logo and two colors).

I see this was supported in the past but is now disabled. Is there not a plan to add support for this later?

[luisrudge]

There is a plan, but no ETA yet.

Luís

---

De: Drew Horn [e-mail]
Enviado: Tuesday, May 14, 2019 12:27:05 AM
Para: auth0/react-native-auth0
Cc: Luís Rudge; Mention
Assunto: Re: [auth0/react-native-auth0] Passwordless without webAuth (#154)

I'm surprised this isn't supported by Auth0. Authentication should be seamless for users and opening up web views disturbs the user experience. The branding options for the hosted views are weak as well (link to logo and two colors).

I see this was supported in the past but is now disabled. Is there not a plan to add support for this later?

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fauth0%2Freact-native-auth0%2Fissues%2F154%3Femail_source%3Dnotifications%26email_token%3DAAHFYE4ANG5QOR34HEWGZWTPVIWQTA5CNFSM4FB5AUP2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODVKFAMI%23issuecomment-492064817&data=02%7C01%7C%7C2bb5b55fb6ed48fd460a08d6d81c09c1%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636934012260898821&sdata=ph2c4F1txRnRPQAcGPzgQ9oTU14lyQ5w7Z8tCiweEDo%3D&reserved=0, or mute the threadhttps://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAAHFYEYINMIF4MZIN7W2YWTPVIWQTANCNFSM4FB5AUPQ&data=02%7C01%7C%7C2bb5b55fb6ed48fd460a08d6d81c09c1%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636934012260908826&sdata=PMQYBz8voOsmHI54zLtqqMFqcjuMP11jj60zuM0VLHQ%3D&reserved=0.

[mikebucks]

This would be super useful. Any update @luisrudge?

[luisrudge]

Not yet :(

[ArronJLinton]

Does the latest release support this?

[lbalmaceda]

@ArronJLinton The latest release only includes support for the latests React Native version. The API and features are the same 👍This is still not being supported from the Auth0 side.

[mtt87]

I've added this guide and would like to get feedback on the approach 😄
https://community.auth0.com/t/passwordless-with-react-native-and-auth0/34056