Hi! I'm developing a first-party native application (Unreal Engine C++ plugin) for my company and we want to implement Ory authentication for our userbase; the plugin will interface with our backend API. From the Ory docs, these seem to be my overall options:
•
Browser app login flow
•
Native app login flow
•
OAuth2 authorization code flow
The issues with each are:
• Browser app login flow generates a session cookie that cannot be intercepted by the native app when done in a system (external) browser. An embedded browser in the native app lets me access the cookie, but it poses a
security risk of leaking credentials or phishing attacks and is discouraged.
• Native app login flow seems like the recommended way, but it requires rendering custom UI in UE (C++) and we prefer to keep it the same as on the web (dev costs, styling, ease of maintenance).
• OAuth2 authorization code flow seems to be
discouraged officially as my use case is only authenticating the user inside the plugin; allowing them to access our backend API.
Who might have experience developing something similar and what approach did you take? This is my first time implementing proper authentication and I'm overall new to the subject matter. I will greatly appreciate guidance in the right direction, as I could easily be missing or misunderstanding something 🙂