Open Radar

 
# Summary

For OAuth use-cases it can be very valuable in order to mitigate client impersonation to know the identity of the app that initiates the authorization request. Previously this was achievable with Universal Links in SFSafariViewController (as only the real app can claim its domain name), but SFAuthenticationSession has no ability to use Universal Links.  If the bundle ID of the app was included as a header in SFAuthenticationSession request, we would have better risk signals during SSO authorization events, and could better protect users.

# Steps to Reproduce
1. Open an OAuth request in SFAuthenticationSession

# Expected Results
The authorization server has no way to verify the calling app.

# Observed Results
The ability to know the identity of the calling app.

# Additional Notes
I would like to suggest the inclusion of a new header, named something like `X-Bundle-ID`, with the header value set to the bundle id of the app. This could be sent on every request in the SFAuthenticationSession so that the authorization server can verify the identity of the calling app.

Example:
`X-Bundle-ID: com.example.app`

NB. while it is possible for a WebView to essentially fake the SFAuthenticationSession's header and user-agent string: in that case there's no SSO (as the cookie jar is always empty). By including this header in SFAuthenticationSession, the server can make better risk-analysis of apps using the SSO session.