Improve authentication logic for authenticated web view #15164

itsmeichigo · 2025-02-17T09:04:53Z

Description

This PR implements the improvements suggested in pe5sF9-3QB-p2. Authenticated web view now handles auto authentication in the web view for the following cases:

WordPress.com authenticated:
- wordpress.com supported URLs.
- Jetpack SSO sites (including both Atomic and self-hosted sites)
Site Credentials authenticated (assuming native login worked for the authentication)

Also, the web view now catches the authentication failures to navigate the user to the original URL in these cases.

Steps to reproduce

Important

To avoid any false positives, please ensure that you are signed out from the WebView after each test by tapping the WordPress logout button manually in the WebView.
If you changed the Jetpack SSO module settings for a site, ensure that you restart the app to fetch the new site modules.
WPS Hide Login that I used in some tests below has issues with redirection, so expect some issues. I couldn't find an alternative plugin that works better, in the past we used to use WP Hide & Security Enhancer which worked well, but its free version doesn't seem to work with Jurassic Ninja sites nor Pressable sites anymore.
Jetpack SSO settings can be accessed from Jetpack Settings in wp-admin (wp-admin/admin.php?page=jetpack#/settings)

TC1: WordPress.com authenticated with a wordpress.com supported link

Sign in using WordPress.com
Open the payments hub.
Tap on "order card reader"
Tap on Log In in the hamburger menu.
Confirm that your WordPress.com account is signed in and suggested as first option.

TC2: WordPress.com authenticated with a Jetpack SSO site

Sign in using WordPress.com
Select a Jetpack website (Atomic or self-hosted) where Jetpack SSO is enabled (can be enabled from Jetpack settings in wp-admin).
Open the dashboard screen.
If needed, add the performance card.
Tap on "View all store analytics"
Tap on "See report" in one of the analytics cards.
Confirm that you are auto-authenticated to your account.
Optional: Set your site to coming soon wp-admin > WooCommerce Settings > Site Visibility. Then on the app, select a published product > View Product in Store and confirm that the product page can be displayed successfully with a banner at the bottom about the coming soon state.

TC3: WordPress.com authenticated with a Jetpack site without SSO

Sign in using WordPress.com
Select a Jetpack website where Jetpack SSO is disabled (can be disabled from Jetpack settings in wp-admin).
Open the dashboard screen.
If needed, add the performance card.
Tap on "View all store analytics"
Tap on "See report" in one of the analytics cards.
Confirm that you see the WPOrg login page instead of being authenticated automatically.

TC4: Site Credentials authenticated using web authorization

Use a self-hosted site.
Install WPS Hide Login plugin.
Open WPS Hide Login settings, and use a custom login URL (Enter the same URL in the redirection URL too).
Open the app and sign in (you might need to perform the Web Authorization twice, because WPS Hide Login doesn't work well with the redirection, but I didn't find a better alternative)
Open the dashboard screen.
If needed, add the performance card.
Tap on "View all store analytics"
Tap on "See report" in one of the analytics cards.
Confirm that you see the WPOrg login page instead of being authenticated automatically.

TC5: Site Credentials authenticated natively

Use a self-hosted site that doesn't use any security measures that could break the native login.
Sign in using site credentials.
Open the dashboard screen.
If needed, add the performance card.
Tap on "View all store analytics"
Tap on "See report" in one of the analytics cards.
Confirm that you are auto-authenticated to your account.

TC6: Site Credentials authenticated natively, but uses custom login URL now

Use a self-hosted site that doesn't use any security measures that could break the native login.
Sign in using site credentials.
Install WPS Hide Login plugin.
Configure WPS Hide Login to use a custom login URL (Enter the same URL in the redirection URL too).
Open the dashboard screen.
If needed, add the performance card.
Tap on "View all store analytics"
Tap on "See report" in one of the analytics cards.
Confirm that the login screen is shown (which is expected in this case given the custom login URL).

Testing information

Tested all the cases above using simulator iPhone 16 Pro iOS 18.1 and 18.2.
Unit tests were added to verify the logic for authentication flow checks.

Screenshots

N/A

I have considered if this change warrants user-facing release notes and have added them to RELEASE-NOTES.txt if necessary.

Reviewer (or Author, in the case of optional code reviews):

Please make sure these conditions are met before approving the PR, or request changes if the PR needs improvement:

The PR is small and has a clear, single focus, or a valid explanation is provided in the description. If needed, please request to split it into smaller PRs.
Ensure Adequate Unit Test Coverage: The changes are reasonably covered by unit tests or an explanation is provided in the PR description.
Manual Testing: The author listed all the tests they ran, including smoke tests when needed (e.g., for refactorings). The reviewer confirmed that the PR works as expected on all devices (phone/tablet) and no regressions are added.

wpmobilebot · 2025-02-17T09:15:48Z

📲 You can test the changes from this Pull Request in WooCommerce iOS by scanning the QR code below to install the corresponding build.

	App Name	WooCommerce iOS
	Build Number	pr15164-75ec99a
	Version	21.7
	Bundle ID	com.automattic.alpha.woocommerce
	Commit	`75ec99a`
	App Center Build	WooCommerce - Prototype Builds #13063

Automatticians: You can use our internal self-serve MC tool to give yourself access to App Center if needed.

itsmeichigo · 2025-02-18T12:15:48Z

WooCommerce/Classes/ViewRelated/Products/Edit Product/ProductFormViewController.swift

-        let stores = ServiceLocator.stores
-        guard let site = stores.sessionManager.defaultSite,
-            stores.shouldAuthenticateAdminPage(for: site) else {
-            WebviewHelper.launch(url.absoluteString, with: self)
-            return
-        }


Using authenticated web view controller now for all product preview - the web view now can check to see if authentication is possible. If not, it would just open the original URL.

selanthiraiyan

Nice work, Huong!

The code LGTM and tests as expected. 🚀

I am sharing a few observations just for information.

I think the 8th point in TC3 is not relevant and should be removed.
With WPS Hide Login installed I had to exit the web view during the login flow and try login again. I think this is expected as your mentioned in test instructions.
With WPS Hide Login installed after logging in to the app, I had to logout of the web view before testing further to avoid false positives. This is expected as you mentioned in the test instructions.

selanthiraiyan · 2025-02-20T05:08:34Z

WooCommerce/Classes/Authentication/AuthenticatedWebViewController.swift

-        } else {
-            loadContent()
+    /// Authentication logic differs depending on the destination URL and the current site.
+    /// More information: https://wp.me/pe5sF9-3Si


Suggested change

/// More information: https://wp.me/pe5sF9-3Si

/// More information: pe5sF9-3Si-p2

Nice catch! Fixed in e9d83df.

selanthiraiyan · 2025-02-20T05:20:00Z

WooCommerce/Classes/Authentication/AuthenticatedWebViewModel.swift

+        guard isAuthenticationFailure else {
+            return false
+        }


❓ Should we rename isAuthenticationFailure into isAuthenticationInProgress? If I understand this correctly, we are checking whether the current url is related to authentication and return false if the url is related to log. This lets the web view proceed further with the navigation and authentication.

I believe isAuthenticationFailure makes more sense here, as the web view fails to handle the authentication (POST request) and attempts to load the login page (the HTLM page) instead.

selanthiraiyan · 2025-02-20T05:21:33Z

WooCommerce/WooCommerceTests/Authentication/AuthenticatedWebViewModelTests.swift

Nice tests. ❤️

dangermattic · 2025-02-20T09:00:06Z

	1 Warning
⚠️	This PR is assigned to the milestone 21.8. This milestone is due in less than 2 days. Please make sure to get it merged by then or assign it to a milestone with a later deadline.

Generated by 🚫 Danger

itsmeichigo · 2025-02-20T09:06:14Z

Thank you Sharma for the review!

I think the 8th point in TC3 is not relevant and should be removed.

I removed this from the PR description ✅

itsmeichigo added 4 commits February 17, 2025 14:41

Add logic to check for authentication flow

31553c2

Update authentication logic for AuthenticatedWebViewController

f49136c

Remove check for previewing product

40e15b8

Use separate authentication logic for atomic sites

f0ec140

itsmeichigo added type: task An internally driven task. feature: core Core work. See "category: tooling" and "category: architecture" labels Feb 17, 2025

itsmeichigo added this to the 21.8 milestone Feb 17, 2025

itsmeichigo added 4 commits February 17, 2025 17:37

Treat atomic and self-hosted sites similarly when SSO is enabled

62a9e73

Update authentication logic to support Jetpack setup

5ae1928

Update logic to avoid early returns

ac24c7e

Move observation logic to a separate method

99be7e3

Base automatically changed from task/15147-check-site-sso to trunk February 18, 2025 02:49

itsmeichigo added 8 commits February 18, 2025 14:46

Inject current site to authenticationFlow method

fdcbadf

Add tests for authenticationFlow method

c77e321

Handle error for authentication

085e0fd

Move ssoRedirectCookieName to constants

6d0eebd

Add tests for authentication failure check

ed3f192

Update release notes

8bd3e7a

Fix endless loop for authentication failure check

82af7d3

Merge branch 'trunk' into task/15147-sso-authenticated-web-view

070ff39

itsmeichigo commented Feb 18, 2025

View reviewed changes

itsmeichigo marked this pull request as ready for review February 18, 2025 12:16

itsmeichigo requested review from pmusolino and selanthiraiyan February 18, 2025 12:16

selanthiraiyan self-assigned this Feb 20, 2025

selanthiraiyan approved these changes Feb 20, 2025

View reviewed changes

Use shorthand for reference link

e9d83df

Merge branch 'trunk' into task/15147-sso-authenticated-web-view

75ec99a

itsmeichigo enabled auto-merge February 20, 2025 09:06

itsmeichigo merged commit 6e32098 into trunk Feb 20, 2025
13 checks passed

itsmeichigo deleted the task/15147-sso-authenticated-web-view branch February 20, 2025 09:29

itsmeichigo mentioned this pull request Nov 6, 2025

Auto authenticate users in web views #16318

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Improve authentication logic for authenticated web view #15164

Improve authentication logic for authenticated web view #15164

Uh oh!

itsmeichigo commented Feb 17, 2025 •

edited

Loading

Uh oh!

wpmobilebot commented Feb 17, 2025 •

edited

Loading

Uh oh!

itsmeichigo Feb 18, 2025

Uh oh!

selanthiraiyan left a comment

Uh oh!

selanthiraiyan Feb 20, 2025

Uh oh!

itsmeichigo Feb 20, 2025

Uh oh!

selanthiraiyan Feb 20, 2025

Uh oh!

itsmeichigo Feb 20, 2025

Uh oh!

selanthiraiyan Feb 20, 2025

Uh oh!

dangermattic commented Feb 20, 2025

Uh oh!

itsmeichigo commented Feb 20, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

	/// More information: https://wp.me/pe5sF9-3Si
	/// More information: pe5sF9-3Si-p2

Improve authentication logic for authenticated web view #15164

Improve authentication logic for authenticated web view #15164

Uh oh!

Conversation

itsmeichigo commented Feb 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Steps to reproduce

TC1: WordPress.com authenticated with a wordpress.com supported link

TC2: WordPress.com authenticated with a Jetpack SSO site

TC3: WordPress.com authenticated with a Jetpack site without SSO

TC4: Site Credentials authenticated using web authorization

TC5: Site Credentials authenticated natively

TC6: Site Credentials authenticated natively, but uses custom login URL now

Testing information

Screenshots

Reviewer (or Author, in the case of optional code reviews):

Uh oh!

wpmobilebot commented Feb 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

itsmeichigo Feb 18, 2025

Choose a reason for hiding this comment

Uh oh!

selanthiraiyan left a comment

Choose a reason for hiding this comment

Uh oh!

selanthiraiyan Feb 20, 2025

Choose a reason for hiding this comment

Uh oh!

itsmeichigo Feb 20, 2025

Choose a reason for hiding this comment

Uh oh!

selanthiraiyan Feb 20, 2025

Choose a reason for hiding this comment

Uh oh!

itsmeichigo Feb 20, 2025

Choose a reason for hiding this comment

Uh oh!

selanthiraiyan Feb 20, 2025

Choose a reason for hiding this comment

Uh oh!

dangermattic commented Feb 20, 2025

Uh oh!

itsmeichigo commented Feb 20, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

itsmeichigo commented Feb 17, 2025 •

edited

Loading

wpmobilebot commented Feb 17, 2025 •

edited

Loading