An OAuth / OpenID authorization URL is loaded inside a WKWebView.

Why this matters

Running the login in an embedded web view lets the host app read the page (cookies, form fields, redirect with the authorization code) and hides the real origin from the user, defeating the isolation an external browser provides; it is disallowed by Google and other providers (CWE-1204 / RFC 8252). AI-generated flows load the provider's authorize endpoint straight into a WKWebView because it is the most direct way to show a login screen.

Use ASWebAuthenticationSession (or SFSafariViewController), which runs the authorization in the system browser with a shared, isolated session and returns via your registered callback URL scheme.

import WebKit

func showLogin(in webView: WKWebView) {
    // ruleid: auth.swift.flow.oauth-in-wkwebview
    webView.load(URLRequest(url: URL(string: "https://accounts.google.com/o/oauth2/auth?client_id=123&response_type=code")!))

    // ruleid: auth.swift.flow.oauth-in-wkwebview
    webView.load(URLRequest(url: URL(string: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=code")!))
}

import WebKit

func showContent(in webView: WKWebView) {
    // A non-auth URL in a WKWebView is fine; OAuth belongs in ASWebAuthenticationSession.
    webView.load(URLRequest(url: URL(string: "https://example.com/help/getting-started")!))
    webView.load(URLRequest(url: URL(string: "https://blog.example.com/2026/release-notes")!))
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.swift.flow.oauth-in-wkwebview -- <reason>

References