A system browser or suitable platform authentication session helps keep the user's password out of the application's direct control.
Evaluation approach
Use the identity provider's supported native-app flow. Do not assume an embedded WebView has equivalent trust and session properties.
Application example
Corporate credentials should not be entered into the application's own password field. Bind the returned result to the initiating request.
Limits and considerations
Browser-based sign-in does not resolve token storage or logout automatically.
Should the application see the password?
In a standard provider flow, the user authenticates in the provider's appropriate session. The application receives evidence of the result rather than asking for the same password again.
Checks and decisions
- Choose supported flows
- Avoid collecting provider passwords
- Validate callbacks
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.