Support SSO login for native apps

Summary Currently we are having hard times when SSO logins should be supported for native apps like react native. The problem is, we don't want to use an "In-App-Browser" due to security concern for users. Such an "In-App-Browser" could be mocked and grab your user credentials. Alternatively a native app would open the phone browser which then authenticates at the SSO and would finally redirect the user to the app using "Deep Link". Here comes the problem. As the Deep Link only opens our app, the app has no access to the phone browser cookies nor will send them at requests. Even if it would send them, these cookies would be cleared when the user would clear the brower cache. Therefore we have currently no access to the auth data when login in via SSO. As a workaround we could create a custom endpoint which redirects to the app via Deep Link and passes as an argument a refresh token: This workaround is not very secure as: • The…