Get Started with iOS Authentication using Swift and UIKit
Tags: security, swift, ios
Published: 2022-08-02 14:33:05

### A step-by-step tutorial on using Auth0 and Swift to implement login/logout and use user metadata in iOS apps.

### <br>

If you make iOS or iPadOS apps, you’ll eventually have to build one that requires users to log in. This article will show you how to use Auth0 to add fully-featured login and logout to a UIKit-based iOS/iPadOS app so that you can focus your time and effort on its *actual* functionality.

Adding authentication — the more formal term for “login/logout” — only _looks_ simple. It often turns into its own project. Just handling the many ways users want to log in can quickly grow into an all-consuming task. You’d also have to deal with user management, scaling, and security issues, each of which has dozens of considerations, risks, issues, and edge cases.

Auth0 solves this problem. With Auth0 and a few lines of code, your app can have a full-featured system that supports logging in with a username/password combination and single sign-on. You’ll also be able to add features such as social accounts, multi-actor authentication, passwordless login, biometrics, and more. You won’t have to update it yourself or handle “behind the scenes” issues, either! Instead, you can concentrate your efforts on what your app does.

### This is a *UIKit*-based app
 
The phrase “May you live in interesting times” is both a blessing and a curse, and it’s an interesting time for iOS and iPadOS developers. That’s because there are currently two very different UI frameworks for iOS development:

1. [**SwiftUI,**](https://developer.apple.com/xcode/swiftui/) which is also known as “the new one.” With SwiftUI, you build user interfaces using Swift code using a *declarative* approach, which means that you specify how the UI should look and what it should do in different states. You don’t have to specify how the UI moves between those states — it takes care of that for you. If you know React programming, you’ll find SwiftUI familiar. We cover adding login and logout to SwiftUI apps in our article, [_Get Started with iOS Authentication using SwiftUI, Part 1: Login and Logout_](https://auth0.com/blog/get-started-ios-authentication-swift-swiftui-part-1-login-logout/).
2. [**UIKit,**](https://developer.apple.com/documentation/uikit/) also known as “the original one.” With UIKit, you build user interfaces by dragging user interface elements onto [storyboards](https://developer.apple.com/library/archive/documentation/General/Conceptual/Devpedia-CocoaApp/Storyboard.html). You then connect those elements to variables and methods in the app’s view controllers using outlets and actions. You program UIKit apps *imperatively,* which means that you define how the app moves between states, how the UI should change appearance when the app changes state, and how the app should behave in different states. **This article is about adding login and logout to _UIKit_ apps.**


## What You’ll Build

You’ll use Auth0 to build a single-screen iOS app that allows users to log in and log out. I’ve purposely kept it as simple as possible to keep the focus on authentication.

While logged in, the user will be able to see the following information from their user profile:

* Full name
* Email address
* Picture

When you launch the completed app, you’ll see a greeting, a **Log In** button, and a disabled **Log Out** button:

![The app’s “Welcome” screen. The “Log In” button is enabled, and the “Log In” button is disabled.](https://images.ctfassets.net/23aumh6u8s0i/4hZG5L93r8PUPz9w6KZLCb/45601dc15211cc4befd4023c0c4c87b1/app_screen_1.png)

> Note that the buttons look like buttons instead of blue text. [iOS 15 introduced four pre-defined button styles](https://useyourloaf.com/blog/button-configuration-in-ios-15/), three of which provide a background that lets the user know that it is indeed a button. The buttons in the app use the _Filled_ button style.

Pressing the **Log In** button starts the process that leads to the [Auth0 Universal Login screen](https://auth0.com/docs/login/universal-login). However, before that happens, the user will see an alert box:

![The app displays the “‘iOS UIKit Login’ Wants to use ‘auth0.com’ to Sign In” alert box.](https://images.ctfassets.net/23aumh6u8s0i/24f6iPlE0d13UV4HXMh9Mw/1604ee7845801d3fe3ce864e848f50fa/app_screen_2.png)

The app delegates the login process to Auth0, and after the user logs in, Auth0 sends information to the app about the user, such as their name, email address, and the URL for the user’s photo. iOS’ privacy policy requires the user to be informed when an app is sending or receiving personal information about the user from a third party (Auth0 in this case). iOS automatically displays the alert to let users know their personal data is being shared as part of the login process.

Pressing the **Continue** button on the alert box takes the user to the [Auth0 Universal Login screen](https://auth0.com/docs/login/universal-login). It appears in a web browser view embedded in your app:

![The default Auth0 Universal Login web page, with Auth0 logo and “email address” and “password” fields.](https://images.ctfassets.net/23aumh6u8s0i/BRb491WFNaF0lzTROs2wn/5fa67f3cae8fcea5d107f6bbe824e4f5/app_screen_3.png)

When you use Auth0 to add login/logout capability to your apps, you delegate authentication to an Auth0-hosted login page. If you use Google web applications such as Gmail and YouTube, you’ve seen this in action. These services redirect you to log in using [accounts.google.com](https://accounts.google.com/). After logging in, Google returns you to the web application as a logged-in user.

> If you’re worried that using Auth0’s Universal Login means that your app’s login screen will be stuck with the default Auth0 “look and feel,” I have good news for you: [you can customize it to match your app or organization’s brand identity.](https://auth0.com/docs/universal-login/new-experience/universal-login-page-templates)

The Universal Login page saves you from having to code your own authentication system. It gives your applications a self-contained login box with several features to provide a great user experience.

If the user enters an invalid email address/password combination, it displays an error message and gives them another chance to log in:

![Universal Login displaying the “wrong email or password” message.](https://images.ctfassets.net/23aumh6u8s0i/6okuc8xzA8P7nawzr8n9pd/453d32967141e28fdbead56f101ebe1a/app_screen_4.png)

There are two ways to exit the Universal Login screen. There’s the “unhappy path,” where the user presses the **Cancel** button at the upper left corner of the screen, which dismisses the Universal Login screen and returns them to the opening screen. When the app detects that the user has canceled login, it displays this alert message:

![Alert box that reads “Please log in. You need to log in to use the app.”](https://images.ctfassets.net/23aumh6u8s0i/3y4glNG6B3Px1uzPmJGjuC/ee0b86421c9b7cf7b520470b14d28918/app_screen_5.png)

The “happy path” out of the Universal Login appears when the user enters a valid email address/password combination. When this happens, Auth0 authenticates the user, the embedded web view and Universal Login will disappear, and control will return to the app, which will now look like this:

![The app in its “logged in” state. The “Log In” button is disabled, “Log Out” button is enabled, and the app’s other controls are visible.](https://images.ctfassets.net/23aumh6u8s0i/6e0rndIioalupkrVQXKBNy/f3926c6014c9d656960ee9ee5a4dfc2f/app_screen_6.png)

Here’s what changed after the user logged in:

* The title text at the top of the screen now says, “You’re logged in.”
* The **Log In** button is disabled, and the **Log Out** button is enabled.
* The name, email address, and photo associated with the user’s account appear onscreen.

As you might expect, the user logs out by pressing the **Log Out** button. Doing so causes the _logout_ alert box to appear: 

![Alert box: “‘iOS Auth’ Wants to Use ‘auth0.com’ to Sign In.”](https://images.ctfassets.net/23aumh6u8s0i/5ysokOyxpnQ68SOYvwjTR6/b2ea6430f8c60ddfa1fa36008f0382c6/app_screen_7.png)

iOS also displays an alert during logout. Once again, this is part of iOS’ security policy, which informs the user that the app is sharing information about them with a third party (Auth0).

> The alert uses the phrase “Sign In” even though the user is _signing out_ of the app. This is an error on Apple’s part, and many developers — us included — have reported this bug.
> 
> It _is_ possible to disable the alert boxes that appear during login and logout, but as you might expect, there are tradeoffs for doing so. You can find out more in the [*Auth0.swift* FAQ](https://github.com/auth0/Auth0.swift/blob/master/FAQ.md).

Pressing the **Continue** button completes the logout process and returns the user to the app, which now looks like this:

![The app is in its “logged out” state. The “Log In” button is enabled, “Log Out” button is disabled, and the app’s other controls are hidden.](https://images.ctfassets.net/23aumh6u8s0i/3HRpkBgBsCPQRE0vvVrSL2/77ab99e8daa7b16d39cf34bffa20e92b/app_screen_8.png)

Note that:

* The text at the top of the screen says, “You’re logged out.”
* The **Log In** button is enabled, and the **Log Out** button is disabled.
* The other controls that were visible when logged in are no longer visible.


[Read more...](https://auth0.com/blog/get-started-ios-authentication-swift-uikit/?utm_source=reddit&utm_medium=sc&utm_campaign=global_dist)