AppAuth-iOS: Unarchive with unarchivedObjectOfClass:fromData:error: fails with Google IdP

Hello,

All users of this library need to persist OIDAuthState, so it would be great if the library would support serialization of this class out of the box.

Today, developers are bound to use deprecated NSCoding apis, because NSSecureCoding support is broken. The Swift compiler does not allow to silence deprecation warnings. This is not a great situation.

In this repository, there are several pull requests that attempt at fixing this issue, at various levels of completion, and all blocked at some stage or another.

Clearly community contributions are unable to fix this problem.

May I suggest that some core contributor would act as a benevolent contributor, take this issue seriously, and provides a reliable serialization solution for OIDAuthState? I can’t point at anybody, of course, but maybe @petea could provide some guidance?

Hi, I’m new here.

I fixed the problem by changing in flie : OIDServiceConfiguration.m line : 188

OIDServiceDiscovery *discoveryDocument = [aDecoder decodeObjectOfClass:[OIDServiceDiscovery class]
                                                                  forKey:kDiscoveryDocumentKey];

to

OIDServiceDiscovery *discoveryDocument = [aDecoder decodeObjectOfClasses:[NSSet setWithObjects:[OIDServiceDiscovery class], [NSDictionary class], [NSArray class], nil]
                                                                  forKey:kDiscoveryDocumentKey];

Wish to help.

In line with what others have reported, I’m able to get get it to work by using NSKeyedArchiver.unarchiveTopLevelObjectWithData() instead of NSKeyedArchiver.unarchivedObject(ofClass:,from:).

Specifically, I have a class AuthState that packages an OIDAuthState and an OIDServiceConfiguration to serialize them together:

class AuthState: NSSecureCoding {
    let state: OIDAuthState
    let config: OIDServiceConfiguration
    
    <implementation of init, NSSecureCoding>
}

let serializedAuthState: Data = try NSKeyedArchiver.archivedData(withRootObject: anAuthState, requiringSecureCoding: true)

// Decodes incorrectly, hits `NSAssert` on `nil` value for `response_type` as described above.
let authState: AuthState = try NSKeyedUnarchiver.unarchivedObject(ofClass: AuthState.self, from: serializedAuthState)

// Succeeds
let authState: AuthState = try NSKeyedUnarchiver.unarchiveTopLevelObjectWithData(serializedAuthState) as! AuthState

As far as I can tell the implementation in AppAuth for those types is good, but obviously we’re missing something. It’s especially interesting to me that the configuration property decodes correctly (per previous comment), and then all the NSString*s come back as nil.

For the moment I’m going to work around this with the workaround as above, but given that method is also deprecated (although not yet removed as of iOS 14.3) a fix here will have some urgency.

For the moment I’m going to work around this with the workaround as above, but given that method is also deprecated (although not yet removed as of iOS 14.3) a fix here will have some urgency.

Agree. At the very least, the documentation and the sample code should be updated

From what I can tell, the problem has to do with the implementation of NSSecureCoding; while unarchiving, the code is listing allowed classes, but that doesn’t match what’s actually encoded in the archive.

You can work around this by manually creating an NSKeyedUnarchiver instance, setting its requiresSecureCoding property to false, and using that to unarchive the blob.