Embedded webview OAuth issues in iOS app (just started this week)

[Articulate M.]

We have an iOS app that has been in production and working great for nearly two months. We're not using the Dropbox SDK, but instead have rolled our own library that uses an embedded UIWebView for handling OAuth and then an implementation that works directly against REST APIs (V2) for access to user data.

As of Dec 15th, everything was working fine. Starting this morning (at least, we just started noticing this morning), the OAuth flow is behaving very erratically. The major difference seems to be the introduction of a new button that allows the user to "Sign in with Google". Sometimes this button appears on the main Dropbox sign-in page and other times it doesn't. The behavior seems fairly random. We're also observing the following behaviors that also happen inconsistetly:

• Often, when tapping into the Email field (and taking no other action), the web view gets automatically redirected to a "Forgot your password?" page. 
• Other times, when tapping into the Email field (and taking no other action), the web view gets automatically redirected to the Dropbox account sign up page. 
• Other times, when tapping into the Email field (and taking no other action), the keyboard comes up briefly, but then immediately dismisses, with focus being lost from the Email field. A second attempt to tap into the Email field works sometimes.

Occasionally, the flow works correctly the way it did before (maybe 10% of the time). 

Here are the OAuth related URLs we're currently using:

• Authorization URL - https://www.dropbox.com/oauth2/authorize 
• Token URL - https://api.dropboxapi.com/oauth2/token 
• Redirect URL - https://www.dropbox.com/1/oauth2/redirect_receiver

For what its worth, we're also using the same custom library for interfacing with Google Drive. Google's OAuth flow continues to work correctly as it always has. This issue seems to be isolated to Dropbox and some recent changes with the OAuth flow. 

Here are two screen recordings that demonstrate successful and unsuccessful OAuth sign in flows using the same app build:

https://360.articulate.com/review/content/6895256c-dab8-41bf-8f19-6d9fb27d31d2/review 
https://360.articulate.com/review/content/5249032a-464a-4377-aaa5-a1f79076ed72/review

This feels like regressions brought on by the new Google sign in flow. I've reported this to Dropbox support, but also posting here incase anyone else is running into this.

[Greg-DB]

Thanks for the post! It looks like your support ticket is already being handled, so we'll follow up there.

[RTS S.]

Could you post the answer here ... I am having a similar problem.

I have not needed to login in long time ... (using a saved token) ... moved to a new tablet and having a problem.

I successfully use the OAuth flow with Google Drive and OneDrive.

I am not sure if this has something to do with:

   //dropbox-api.arkoselabs.com/...

[Greg-DB]

@RTS S. The issue that was originally reported here was fixed on Dropbox's side. This thread is very old now though, and things have changed since then.

We now document that the /oauth2/authorize page should be processed in the user's system browser anyway. If you're not already doing that, please update your app to do so.

If something still isn't working as expected for you, please open a new thread with the details of the issue you're seeing so we can help.