Feature Request: Allow prefersEphemeralWebBrowserSession in iOS (disable "true" SSO)

[thorsten-wolf-neptune]

Hi all,

first of all. Thanks for this amazing plugin! We really love using it :-)

One feature request we have and think is pretty easy to implement is to allow configuring "true" SSO or "forced reauthentication" for oauth login session.
Currently on iOS (if ASWebAuthenticationSession is used) the window.open request will bring a native prompt asking the user that the app wants to login to the target idp provider.
So the safari browser that will show up after the user confirms this dialog might reuse existing session cookies and other data from safari. So th user might have a "true" SSO experience as an already existing login might automatically take place.

However there is usecases where you might want the user to be forced to reauthenticate.
IOS thought of this by having a property called prefersEphemeralWebBrowserSession
(see https://developer.apple.com/documentation/authenticationservices/authenticating-a-user-through-a-web-service#Optionally-Request-Ephemeral-Browsing and https://developer.apple.com/documentation/authenticationservices/aswebauthenticationsession/prefersephemeralwebbrowsersession )

The implementation would be very simple as it just would require to set that property to true before calling start().
Actually there is a fork that is doing exactely that:
https://github.com/TrustlyInc/cordova-plugin-oauth/blob/5a4a91906818d7a8278b383f3da5b0d435c2d2c1/src/ios/OAuthPlugin.swift#L52

So it would be really awesome to have a parameter that allows configuring wheather a "true" SSO experience should be initiated or a forced reauthentication should be required regardless if the user is already signed in with the native browser.

As the window.open function has an optional third parameter for "features" that currently doesn't seem to be used it would be great to allow passing a JSON that could contain a property that would lead to setting prefersEphemeralWebBrowserSession to true.

What do you think?

Cheers
Thorsten

[dpogue]

I think this makes sense to add, although it doesn't appear that Android has any equivalent, and it would probably only work on a subset of iOS versions (although Cordova itself doesn't really support anything older than iOS 13 going forward).

Using the window features parameter makes sense (and I'm considering also supporting a oauth=true option there instead of prefixing the window name, for better web compatibility).