SSO approach for native mobile app with web views? : <p>So the standard SSO approach for native mobile apps (both Android and iOS) appears to be OAUth2 + OpenID Connect via the AppAuth library.</p>

<p>That's all well and good -- and actually seems to approach elegance.</p>

<p>But what if the very same app contains embedded web view component(s) which need to access resources using the same SSO (on the same server in the same web apps as the native code where all resources require authentication for access)?</p>

<p>For starters, OAuth2 access tokens (once acquired) are not automatically propagated to , , etc, hyperlink requests within a web app, right?  So do the web app pages themselves really have to be reworked with JavaScript to do such propagation?  The mobile app can rewrite the requests to address this, but:</p>

<ol>
<li>At least on Android this only applies to GET requests (right?)</li>
<li>More critically, this assumes the web app does not need to function in a normal browser client</li>
</ol>

<p>Is OAuth2 not the right approach here?  If so, that seems a shame -- as AppAuth seems pretty nice for the native app side of things.  It's just blending basic web view browsing into the picture that really makes a mess of things.</p>

<p>Or is there just some de facto standard JavaScript library that one can mix in with Angular or the like (and then require use of Angular or the like)?</p>
