feat: allow configuring Auth0.Android's native networking client - #1637
feat: allow configuring Auth0.Android's native networking client#1637NandanPrabhu wants to merge 2 commits into
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
💤 Files with no reviewable changes (1)
📝 WalkthroughWalkthroughAdded optional Android networking options for timeouts, default headers, and logging. The options flow through the TypeScript and native bridge layers into an Android ChangesAndroid networking options
Estimated code review effort: 3 (Moderate) | ~25 minutes Merge Risk: 🟠 High · up to The new Android networking configuration can expose token-bearing request and response bodies in release logs, and later initializations may unexpectedly retain networking settings from an earlier initialization. These security and configuration-isolation risks should be fixed or explicitly accepted before merge. Sequence Diagram(s)sequenceDiagram
participant NativeAuth0Client
participant NativeBridgeManager
participant A0Auth0Module
participant DefaultClient
NativeAuth0Client->>NativeBridgeManager: initialize(..., androidNetworkingOptions)
NativeBridgeManager->>A0Auth0Module: initializeAuth0WithConfiguration(..., androidNetworkingOptions)
A0Auth0Module->>DefaultClient: build client with timeouts, headers, and logging
A0Auth0Module->>A0Auth0Module: apply DefaultClient when options are provided
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Adds `androidNetworkingOptions` to `Auth0Options`, letting apps tune the OkHttp-based `DefaultClient` (connect/read/write/call timeouts, default headers, and debug logging) that Auth0.Android uses for every native request. Android only; accepted and ignored on iOS for API compatibility. Ref: SDK-10614
01e7644 to
4b062f9
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@android/src/main/java/com/auth0/react/A0Auth0Module.kt`:
- Line 313: Update the initialization flow around androidNetworkingOptions and
Auth0.getInstance(clientId, domain) so the Auth0 instance’s networkingClient is
explicitly reset to DefaultClient() when options are absent, while retaining
buildNetworkingClient(it) for provided options. Add a test covering
same-configuration re-initialization after custom networking options, verifying
the client is restored to the default.
In `@src/types/common.ts`:
- Around line 247-256: Update the Android native mapping of enableLogging so it
is forwarded to DefaultClient.Builder.enableLogging only when the Android debug
build flag is enabled; release builds must force logging off regardless of the
public option. Add a release-build test covering enableLogging=true and
confirming the native logger remains disabled.
Apply the same fix in `@android/src/main/java/com/auth0/react/A0Auth0Module.kt` at
line 83.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 64ea7502-a514-4d9e-a609-5dba9b89b706
📒 Files selected for processing (14)
EXAMPLES.mdandroid/build.gradleandroid/src/main/java/com/auth0/react/A0Auth0Module.ktandroid/src/test/java/com/auth0/react/A0Auth0ModuleNetworkingOptionsTest.ktios/A0Auth0.mmsrc/core/utils/__tests__/configSignature.spec.tssrc/core/utils/configSignature.tssrc/platforms/native/adapters/NativeAuth0Client.tssrc/platforms/native/adapters/__tests__/NativeAuth0Client.spec.tssrc/platforms/native/bridge/INativeBridge.tssrc/platforms/native/bridge/NativeBridgeManager.tssrc/platforms/native/bridge/__tests__/NativeBridgeManager.spec.tssrc/specs/NativeA0Auth0.tssrc/types/common.ts
|
|
||
| this.useDPoP = useDPoP ?: false | ||
| auth0 = Auth0.getInstance(clientId, domain) | ||
| androidNetworkingOptions?.let { auth0!!.networkingClient = buildNetworkingClient(it) } |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -e
printf '%s\n' '--- target context ---'
sed -n '260,340p' android/src/main/java/com/auth0/react/A0Auth0Module.kt
printf '%s\n' '--- Auth0 dependency declarations ---'
rg -n -i 'auth0.android|auth0-android|com.auth0' android gradle* build.gradle* settings.gradle* package.json yarn.lock 2>/dev/null | head -200
printf '%s\n' '--- initialization and networking usages ---'
rg -n 'initializeAuth0WithConfiguration|buildNetworkingClient|networkingClient|androidNetworkingOptions|Auth0\.getInstance' android/src android 2>/dev/null | head -250Repository: auth0/react-native-auth0
Length of output: 22137
🏁 Script executed:
#!/bin/bash
set -e
printf '%s\n' '--- target context ---'
sed -n '260,340p' android/src/main/java/com/auth0/react/A0Auth0Module.kt
printf '%s\n' '--- Auth0 dependency declarations ---'
rg -n -i 'auth0.android|auth0-android|com.auth0' android gradle\* build.gradle\* settings.gradle\* package.json yarn.lock 2>/dev/null | head -200
printf '%s\n' '--- initialization and networking usages ---'
rg -n 'initializeAuth0WithConfiguration|buildNetworkingClient|networkingClient|androidNetworkingOptions|Auth0\.getInstance' android/src android 2>/dev/null | head -250Repository: auth0/react-native-auth0
Length of output: 22137
🏁 Script executed:
#!/bin/bash
set -e
url='https://raw.githubusercontent.com/auth0/Auth0.Android/4.0.1/auth0/src/main/java/com/auth0/android/Auth0.kt'
python3 - "$url" <<'PY'
import sys
from urllib.request import urlopen
url = sys.argv[1]
text = urlopen(url, timeout=10).read().decode()
for i, line in enumerate(text.splitlines(), 1):
if 'getInstance' in line or 'networkingClient' in line or 'companion object' in line:
start = max(1, i - 8)
end = min(len(text.splitlines()), i + 14)
print(f'--- lines {start}-{end} ---')
print('\n'.join(f'{n}: {text.splitlines()[n-1]}' for n in range(start, end + 1)))
PYRepository: auth0/react-native-auth0
Length of output: 2448
🌐 Web query:
Auth0.Android 4.0.1 Auth0.getInstance networkingClient singleton source
💡 Result:
In the Auth0.Android SDK (including version 4.0.1), the Auth0.getInstance method acts as a factory that returns a singleton instance of the Auth0 class for a given configuration [1]. Regarding your query about the networkingClient: 1. Singleton Behavior: The Auth0 class is managed as a singleton per configuration [1]. When you call Auth0.getInstance, it checks if an instance with the specified client ID and domain already exists; if so, it returns that existing instance [1]. 2. NetworkingClient Property: The Auth0 instance contains a networkingClient property (type NetworkingClient) which is used for all HTTP requests made by the library's various API clients (e.g., AuthenticationAPIClient, UsersAPIClient) [2][3][4]. 3. Customization: By default, this property is initialized with a DefaultClient [3]. You can replace it with a custom implementation by setting the networkingClient property directly on your Auth0 singleton instance [2][3]. Example of configuring the networking client: val account = Auth0.getInstance("{YOUR_CLIENT_ID}", "{YOUR_DOMAIN}") account.networkingClient = CustomNetworkingClient // Replace with your implementation Note that because the Auth0 instance is a singleton, changing the networkingClient on that instance will affect all subsequent API operations that rely on that specific Auth0 account instance [4].
Citations:
- 1: https://github.com/auth0/Auth0.Android/blob/main/V3_MIGRATION_GUIDE.md
- 2: https://auth0.com/docs/libraries/auth0-android/auth0-android-custom-networking-client
- 3: https://context7.com/auth0/auth0.android/llms.txt?tokens=10000
- 4: Receive NetworkingClient through the Auth0 instance Auth0.Android#440
🏁 Script executed:
#!/bin/bash
set -e
url='https://raw.githubusercontent.com/auth0/Auth0.Android/4.0.1/auth0/src/main/java/com/auth0/android/Auth0.kt'
curl -fsSLk "$url" | nl -ba | awk '
/companion object|fun getInstance|networkingClient|private constructor|class Auth0/ {
start = NR - 8; if (start < 1) start = 1
end = NR + 14
print "--- lines " start "-" end " ---"
for (i = start; i <= end; i++) lines[i] = lines[i]
}
{ lines[NR] = $0 }
END {
# Re-read is not possible in this one-pass filter; print source-focused matches instead.
for (i = 1; i <= NR; i++)
if (lines[i] ~ /companion object|fun getInstance|networkingClient|private constructor|class Auth0/)
print i ":" lines[i]
}'
printf '%s\n' '--- local client builder and imports ---'
sed -n '1,105p' android/src/main/java/com/auth0/react/A0Auth0Module.ktRepository: auth0/react-native-auth0
Length of output: 6617
Reset the networking client when options are omitted.
Auth0.getInstance(clientId, domain) reuses the same instance. A later initialization without androidNetworkingOptions preserves the previous custom networkingClient. Assign DefaultClient() when the options are absent, and add a same-configuration re-initialization test.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@android/src/main/java/com/auth0/react/A0Auth0Module.kt` at line 313, Update
the initialization flow around androidNetworkingOptions and
Auth0.getInstance(clientId, domain) so the Auth0 instance’s networkingClient is
explicitly reset to DefaultClient() when options are absent, while retaining
buildNetworkingClient(it) for provided options. Add a test covering
same-configuration re-initialization after custom networking options, verifying
the client is restored to the default.
Source: MCP tools
| /** | ||
| * Enables verbose HTTP request/response logging to Logcat. | ||
| * | ||
| * @remarks | ||
| * **Debug-only.** Auth0.Android logs full request and response bodies at this level, | ||
| * which includes access, refresh, and ID tokens in plaintext for token-endpoint calls. | ||
| * Never enable this in production. | ||
| * @default false | ||
| */ | ||
| enableLogging?: boolean; |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Enforce debug-only logging in the native implementation.
enableLogging is a public boolean. The Android mapper forwards it directly to DefaultClient.Builder.enableLogging. Auth0.Android then installs a BODY logging interceptor, which logs token-endpoint request and response bodies. A release build can therefore log access, refresh, and ID tokens when an application sets this option. (raw.githubusercontent.com)
Gate this option with the Android debug build flag before enabling the logger. Add a release-build test that confirms the option cannot enable logging.
As per coding guidelines: “Never commit secrets, API keys, or tokens, and never log access, refresh, or ID tokens.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/types/common.ts` around lines 247 - 256, Update the Android native
mapping of enableLogging so it is forwarded to
DefaultClient.Builder.enableLogging only when the Android debug build flag is
enabled; release builds must force logging off regardless of the public option.
Add a release-build test covering enableLogging=true and confirming the native
logger remains disabled.
Apply the same fix in `@android/src/main/java/com/auth0/react/A0Auth0Module.kt` at
line 83.
Source: Coding guidelines
…ild.gradle Verified the new A0Auth0ModuleNetworkingOptionsTest suite passes identically with or without this option — nothing in buildNetworkingClient()'s path touches an unstubbed Android framework API, so the fallback is dead config.
fe1855c to
312fbe0
Compare
2 participants
Summary
androidNetworkingOptionstoAuth0Options, exposing Auth0.Android'sDefaultClient.Builder(connect/read/write/call timeouts, default headers, debug-only request logging) for every native request the SDK makes (web auth, credential renewal, MFA, passkeys, My Account API).enableLoggingis intentionally debug-only since Auth0.Android logs full request/response bodies (including tokens) at that level.Ref: SDK-10614
Test plan
yarn typecheck— cleanyarn test— 36/36 suites, 712/712 tests pass (new coverage inconfigSignature.spec.ts,NativeAuth0Client.spec.ts,NativeBridgeManager.spec.ts)yarn lint— clean on all changed files./gradlew :react-native-auth0:testDebugUnitTest) — newA0Auth0ModuleNetworkingOptionsTest(2/2) verifiesreadTimeoutanddefaultHeadersare genuinely applied to the builtDefaultClientagainst a realMockWebServerEXAMPLES.mdupdated with a new "Android Networking Configuration" sectionSummary by CodeRabbit
New Features
Tests