OAuth uses SFSafariViewController or Custom Tabs, not embedded WebView

An embedded WebView used for OAuth credential entry violates Apple's guideline 5.1.1 and the OAuth 2.0 security model: the app can read the WebView's DOM content, giving it access to the user's credentials on the OAuth provider's login page. CWE-522 (insufficiently protected credentials) applies directly. Google, Apple, and GitHub explicitly prohibit embedded WebView OAuth because it enables phishing — an app can silently capture the username and password typed into what appears to be Google's login form. The correct implementations (SFSafariViewController, AuthenticationSession, Chrome Custom Tabs) operate in a separate process the app cannot read.

Replace any WebView OAuth flow with expo-auth-session, which uses SFSafariViewController on iOS and Chrome Custom Tabs on Android.

// src/screens/LoginScreen.tsx
import * as Google from 'expo-auth-session/providers/google';

export default function LoginScreen() {
  const [request, response, promptAsync] = Google.useAuthRequest({
    clientId: process.env.EXPO_PUBLIC_GOOGLE_CLIENT_ID,
  });

  useEffect(() => {
    if (response?.type === 'success') {
      const { authentication } = response;
      // exchange authentication.accessToken for your session
    }
  }, [response]);

  return <Button title="Sign in with Google" onPress={() => promptAsync()} />;
}

For Apple Sign In (required when offering any third-party sign-in on iOS), use expo-apple-authentication. Never use a <WebView source={{ uri: 'https://accounts.google.com/...' }} /> for credential entry.