7

Say you have a smartphone with two browsers, DefaultBrowser and OtherBrowser.

  • You visit the webshop by opening Otherbrowser, and proceed through the cart steps
  • At the end, you go from OtherBrowser to PaymentApp to pay.
  • After you've paid, PaymentApp closes and opens the confirmation URL in the DefaultBrowser.

And that last step is a problem. DefaultBrowser doesn't have the right session, OtherBrowser does. The PaymentApp does as expected, it opens a browser instance and the OS picks the set default.

I strongly prefer not to set a new session in DefaultBrowser based and feedback parameters (like order_id) as I want to keep it as secure and transparent as possible. Extra downside of this is that the real session is still alive in OtherBrowser which might lead to other problems or confusion.

Does anyone have a solution for this? I'm not perse looking for some code, instead im looking for a concept which could fix it as good as possible.

Some additional information:

  • We do not own the app. I can contact them, but it's a bank app and I'm a mere peasant.
  • Other big webshops have the exact same situation.
  • This is not brand related, Android/iOS (and likely WinPhone) have this problem.
  • This is not app related, we tried a few bank apps, all have this exact problem.
Improve this question
4
  • Since you're looking for a way to securely pass session information between a banking app and mobile browsers, SEC.SE should have valuable input. Advise updating your title before doing so. Commented Jul 2, 2016 at 20:29
  • 2
    I'd expect this to require significant changes to the payment app, so if you're not its author, you'll have little choice. Commented Jul 4, 2016 at 7:20
  • I agree, and because of that I'm hoping someone has a nice Plan B solution. Commented Jul 4, 2016 at 11:11
  • I think the only possible way is for you to securely create a new session in the default browser. Commented Jul 17, 2016 at 9:57

1 Answer 1

Reset to default
1

On both Android and iOS the PaymentApp can open any browser it wants. If it's made to always open a default browser, the only way to force it opening another browser is by changing a default browser (btw this only works on Android, not on iOS). If you have control over the PaymentApp, you can force it to open another browser. On Android the mechanism is called "intents" and "deep links", on iOS it's done via "custom url schemes" or "universal links".

Every browser has a special way to identify itself (by a web page code) and a way to open it (from any native app). The way it could work is that the webshop should identify the browser, and pass that information to the PaymentApp. Later on the PaymentApp needs to use the information to open a right browser.

Since you don't control the PaymentApp (and I suppose they don't care fixing it for you), the only solution would be to inform the webshop client that the chosen payment method requires Safari or Chrome, and reopen the page in that browser instead (passing a session ID).

I'm a mobile web browsers software developer, and this is a known problem for any 3rd party browser app, especially on iOS where Safari usurps the system.

See docs: https://developer.android.com/training/app-indexing/deep-linking.html https://developer.apple.com/library/ios/documentation/General/Conceptual/AppSearch/UniversalLinks.html

Improve this answer

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.