Hi all,
This is to start a discussion thread and hopefully to develop a formal
consensus on how Apache Cordova should handle the upcoming requirement
regarding zero-tap sign in.
If you're not already familiar, Google has announced that starting April
2027, apps supporting a user sign-in flow (whether mandatory or
optional) must automatically restore the sign-in state when the user
migrates the app from one device to another, using the Android Restore
Credentials API. The announcement can be found at
https://android-developers.googleblog.com/2026/08/app-quality-memory-optimization-secure-onboarding.html
near the bottom, under the "Providing a secure & seamless device
migration experience" header.
Generally when things are add-ons, we leave that to the community to
support so that Apache can focus on bridging the gaps in web features
and supporting the core platform, and that could probably extend to
restore credentials integration as well, because Apache doesn't provide
any tools for supporting user sign-in flows either, no apache-maintained
API for accessing the encrypted storage mechanism to store access
tokens, but users **could** get by with using web storage. User sign-in
flows is something that is very common requirement in many apps so that
begs the question and I believe will start requiring app integration. So
that begs the question on:
1) Whether Apache Cordova should provide a Restore Credentials Solution
2), and if so, should the solution be part of the core android framework
or be a separate plugin to be installed.
Or should the community take responsibility of providing the Restore
Credentials integration.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
