WebAuthProvider's callback URI uses https

[newt-beach]

After following following this WebAuthProvider guide, the browser authenticates and closes, but instead of going back to the app an intent picker is shown, prompting the user to pick whether they'll open the callback in our app or in the browser:

This is an issue because the average user is likely to get confused by this dialog, and if the browser is set as the default handler for the callback this way, there's no easy way for them to reset the default.

Currently when using a WebAuthProvider, the callback URI is of the form: https://{AUTH0_DOMAIN}/android/{BUNDLE_NAME}/callback.
However, for Android to know to open our app on the first try, the callback URI should be of the form: {BUNDLE_NAME}://{AUTH0_DOMAIN}/android/{BUNDLE_NAME}/callback.

Currently, it's working on iOS, with the bundle identifier as the URI protocol.

[hzalaz]

Currently, it's working on iOS, with the bundle identifier as the URI protocol.

It works since it's the only way it could work without using Universal Links, which is hard to setup.

We are considering adding the option to allow to choose the scheme and document better the use of Android AppLinks that will mitigate this issue

[lbalmaceda]

Merged. Will be available on the next release.