HTTPS App Links don't open app

[willyboy]

Checklist

• The issue can be reproduced in the auth0-angular sample app (or N/A).
• I have looked into the Readme, Examples, and FAQ and have not found a suitable solution or answer.
• I have looked into the API documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

When setting the redirect_uri to an https app link (Android app links), auth0 redirects to the https link and the browser doesn't close. When using a com.app.apptype style link, the browser does close.
I have determined that this is an issue with auth0 because the exact same code works with Amazon's auth flow.

Reproduction

1. When using a redirect_uri that is https, the browser that is opened redirects to the url and does not navigate back to the app even though example.com is set up as an App Link and confirmed to be working:
2. Browser.open({
   url: https://login.example.com/authorize?response_type=code&client_id=xyz&redirect_uri=encodeURICOmponent('https://example.com'),
   windowName: '_self',
   });
3. When the redirect_uri is of the format com.app.app, the browser closes and links back into the app as expected.

Additional context

The app links are confirmed to be working and when the same flow is followed for linking to Amazon, the browser does close on Amazon's redirect.
The only difference I can think of is that for Amazon, there's a button to click (allow) before the browser window closes. If this bug is related to auth0 doing a redirect and not having user interaction with the page, then I'm not sure how to handle it.

auth0-angular version

2.2.3

Angular version

18.0.1

Which browsers have you tested in?

Chrome

[willyboy]

@frederikprijck any thoughts?

[willyboy]

For anyone else stumbling on this issue, using window.location.href instead of Browser.open will get the app to recognize that when the redirect_url is called, it's supposed to open the app.

[yogeshchoudhary147]

Hi @willyboy, sorry for the delay.

Thanks for sharing that workaround. This is a common Android issue where Chrome requires a user gesture to trigger an HTTPS App Link, while custom schemes (com.app://) don't.

It's interesting that window.location.href works better than Browser.open here. Are you still using this fix, and does it work consistently for you on iOS too?

I'll check if we need to update our documentation for this.

[yogeshchoudhary147]

Looks like the workaround using window.location.href resolved this since there has been no follow up. Closing for now, feel free to reopen if the issue persists.