Get the most out of Sign in with Apple
By: Jinha Park
Tags: WWDC, Xcode, iOS, Swift, Wwdc20

Get the most out of Sign in with Apple

🗂WWDC2020 | Session : 10173 | Category : Privacy and Security 🔗 https://developer.apple.com/videos/play/wwdc2020/10173/ 🔖 Sign in with Apple makes it easy for people to sign in to your apps and websites with the Apple ID they already have. Fully integrate Sign in with Apple into your app using secure requests, and by handling state changes and server notifications. We’ll also introduce new APIs that allow you to let existing users switch to Sign in with Apple quickly and easily. Related : Introducing Sign In with Apple — WWDC19 (Introducing Sign In with Apple)

 Creating a secure request

These nonce and state properties will allow you to verify that the authorization and credential you get after executing a request are the ones you were expecting.

Securing your request

Nonce

The nonce is an opaque blob of data sent as a string in the request.

It is important to generate one unique nonce every time you create a new request as later on you will be able to verify this value.

This will allow you to verify this value in your server, helping prevent replay attacks.

State

The state value is also an opaque blob of data sent with the request.

Once key difference he has with the nonce value is that the state will be returned in the credential allowing you to locally match a credential to a request and verify this was generated from your application.

Response Private email relay

Example on how to get a credential from an authorization

Inside of credential you will find properties containing the user information that you requested like name and email. You will also find important properties that will allow you to securely verify the request and create a session with your servers.

Verifying Credentials

Response

Cache the objects locally It is important to cache the objects you need in case of the failure communicating with your server due to poor connectivity.

Verify the state value Make sure you verify the state value of the credential to be the same state value you previously generated.

Validate the information with Apple The response contains an authorization code an identity token. Send these values to your server where they can be decoded. Once decoded, verify the received information as well as session with Apple servers.

How will the entry token will look when decoded by your server

subject : A user identified that was returned to you on the authorization and will allow to create a session in your servers.

: A user identified that was returned to you on the authorization and will allow to create a session in your servers. nonce : Verify these to be the same nonce you generated previously in the request. This will allow you to verify the authenticity of the authorization and help mitigate replay attacks.

: Verify these to be the same nonce you generated previously in the request. This will allow you to verify the authenticity of the authorization and help mitigate replay attacks. real_user_status : 0 - unsupported, 1 - unknown, 2 - likely real

Identity token and authorization code

You can exchange the authorization code with the Apple ID servers. And when this is successful you will receive a refreshed token and an access token for future calls as well as a new identity token that should be identical to the one you already have.

You may verify a refresh token once a day to confirm that the user’s Apple ID on that device is still in good standing.

 Credential state changes

getCredentialState API allows you to verify the current state of a credential by sending the currently stored user identifier.

It is important that this method is called every time your application is launched or changes to the foreground. That way you will be able to react on time to any changes in status and present the appropriate scheme in your application to your user.

.authorized : You can fast track the user directly to your application and skip the login UI.

: You can fast track the user directly to your application and skip the login UI. .revoked : The user decided to sign out of your application. In this scenario you should sign the user out of your application. Close your session and present the login screen

: The user decided to sign out of your application. In this scenario you should sign the user out of your application. Close your session and present the login screen .notFound : This will be returned when there was no credential matching the user identifier. Present a login screen so that the user can authenticate your application.

: This will be returned when there was no credential matching the user identifier. Present a login screen so that the user can authenticate your application. 🆕 .transferred

🆕 Transferred State

Ownership changed This will only be received by application that recently were transferred from one development team to another. (ex. after a company’s acquired)

User migration needed User identifiers are unique to a team. So when transferring ownership of an application, the existing user will need to be migrated to a new user identifier to match the new team.

Silent migration This migration is handled silently. This is without any user interaction and can be triggered calling the same API used to create a new account or logging the user.

We can validate the transfer state of the user and generate the new user identifier that will match the new team.

 Server notifications

🆕 Server to server developer notifications

Listening to these notifications will allow you to monitor things like credential state changes right from your server as well as receive other types of events.

Register You have to register your server endpoint on the Apple developer’s website.

JWT Event Events will be sent as JSON web tokens signed by Apple.

The email-disabled event which you can get if a user has decided to stop receiving emails on their email relay. The email enabled event means that the user opted back into receiving email messages.

It is important to note that this event as well as the email disabled will only be sent when the user previously decided to use a private email relay for their account.

The consent-revoked event will be sent to you when a user decided to stop using their AppleID with your application and should be treated as a sign out by the user.

 Sign in with Apple Button

🆕 Swift UI support

onRequest : This is the right place to add the requested scopes like name and email and the nonce state values.

onCompletion : We will get the result of the request and handle the success or failure cases just as you would on the delegate methods for the authorization controller.

.signInWithAppleButtonStyle : We can also select the Button style.

Styles

Black

White

White outline

If you need to personalize the Sign in with Apple Button more to match the specific design of your website or application → a new online portal

🆕 Online Button editor

https://appleid.apple.com/signinwithapple/button

 🆕 Upgrading to Sign in with Apple

What about users that are already using a traditional username and password based account and don’t want to fork their current account?

Secure It’s secure for both you and your users. Upgrading to Sign in with Apple is the easiest way to convert your accounts to two factor authentication.

Reduce complexity Account recovery is also a lot less complicated with Sign in with Apple.

Prevent duplicate accounts Utilizing this API will prevent the duplication of accounts.

→ Users that are already using a traditional username and password based account won’t abandon their current account, they can just upgrade.

Overview

One Tap Account Security Upgrades — WWDC20

Three flow for upgrades