🎯 Objective
This article aims to explain how Single Sign-On (SSO) works in Webviews and MicroApps, highlighting the differences in session persistence and authentication mechanisms.
🧭 Key Definitions
Webview
A Webview is a component integrated into a mobile application that allows displaying web content. It acts as an embedded browser, providing a smooth user experience without leaving the app.
MicroApp
A MicroApp is an autonomous feature embedded in a main application. It generally interacts with backend services via APIs, without requiring a web interface.
🔐 SSO Functionality in Webviews
🔄 Session Sharing
In a mobile application, a single instance of Webview is generally used. This means that:
Session cookies are shared among different Webviews.
Once the user is authenticated via SSO in a Webview, the session remains active for other services accessible via Webview, as long as the session has not expired.
For example, if a student logs in to a housing service via SSO in a Webview, they will not need to reconnect to access another service using the same instance of Webview.
⚠️ Limitations
It is important to note that:
Session persistence depends on the validity of the cookies. If the cookies expire or are deleted, re-authentication will be necessary.
Webviews do not share cookies with external browsers. Thus, an active session in a Webview is not recognized in the device's native browser, and vice versa.
🤖 SSO Functionality in MicroApps
MicroApps do not rely on Webviews for authentication. Instead, they use Machine-to-Machine (M2M) mechanisms to interact with backend services.
🔐 M2M Authentication
In this context:
The mobile app acts as a trusted client, authenticating with the backend service via access tokens obtained through the OAuth 2.0 Client Credentials flow.
No user interaction is required for authentication, as credentials are exchanged directly between machines.
This mechanism is particularly suited for services requiring secure communication between applications, without human intervention.
📊 Comparison between Webviews and MicroApps
Characteristic | Webview | MicroApp |
Authentication Type | SSO via embedded browser | M2M Authentication via API |
Session Persistence | Depends on session cookies | Managed by access tokens with expiration |
User Interaction | Requires initial login action | None, everything is managed in the background |
Session Sharing | Possible between Webviews in the same instance | Not applicable |
✅ Best Practices
Webviews:
Ensure that session cookies are properly managed and persistent to maintain the SSO connection.
Inform users that the session may expire and re-login might be necessary.
MicroApps:
Use access tokens with appropriate lifespans to balance security and performance.
Implement token refresh mechanisms if necessary.
Understanding the differences between Webviews and MicroApps in terms of SSO can help you choose the solution best suited to your needs, ensuring a seamless and secure user experience.
Useful Resources: