Authentication Methods

App to Browser Redirection

This version is:

Published 3 years ago 31 Mar 2021
App-to-browser redirection – AIS It is possible that a PSU using a mobile device does…

Other pages in this section

App-to-browser redirection – AIS

It is possible that a PSU using a mobile device does not have their ASPSP mobile app installed, or their ASPSP does not provide an app at all. In these instances, the TPP app will need to launch the native mobile browser in order to present the PSU with their ASPSP’s web channel to authenticate.

It is imperative in these circumstances that the browser channel has been optimised for mobile browser and device type. 

Browser-to-app redirection

Conversely, a TPP may be browser only, but this should not preclude a PSU from having their ASPSP app invoked if the PSU is using a mobile browser and has the ASPSP app installed on their device. In this situation, the TPP browser should invoke the app for authentication and following authentication, the PSU needs to be redirected back to the TPP browser.

If a PSU is using a desktop to access the TPP, then under the redirection model the journey will have to be completed on the ASPSP browser channel. Only with Decoupled authentication can the PSU use their app to authenticate in this situation.

Effective use of redirection screens

Within a typical redirection journey, a customer is presented with two redirection screens:

  • Inbound redirection screen (from TPP to ASPSP) – owned by the TPP – from the TPP domain to the ASPSP domain, after the PSU has provided consent to the TPP for the account information or payment initiation service. For the avoidance of doubt, ASPSPs must not present any additional inbound redirection screens.
  • Outbound redirection screen (from ASPSP to TPP) – owned by the ASPSP – from the ASPSP domain to the TPP domain, after the ASPSP has authenticated the PSU.

The research has suggested that the redirection screens are a useful part of the process, providing customer trust. The following reasons are noted:

  • They help customers navigate their online journey and inform them of what is going to happen next.
  • They help create a clear sense of separation between the TPP’s domain and the ASPSP’s domain.

The research has suggested that the messaging on the redirection screens serves to reassure the customer that they are in control and helps engender trust. For example, customers will be more willing to trust the process if they feel there is a partner (TPP or ASPSP) on their side that is known and reputable (use language such as ‘we’, ‘our’). In this sense, the use of words that indicate that the customer is in control and taking the lead are key, as these are indications that the TPP or the ASPSP is working with or for the customer.

 

Main content image

Main content image

Error scenarios during redirection 

As per OIDC, there are 2 main scenarios when an error occurs at the ASPSP side during the authorisation process:

The ASPSP could potentially display an error message to the PSU before redirecting back to the TPP, but it is solely at their discretion. The TPP should check the OIDC error code and display additional messages to the PSU with further information. messages.

Error responses are documented as below:

For OIDC: https://openid.net/specs/openid-connect-core-1_0.html#AuthError

For OAuth 2: https://tools.ietf.org/html/rfc6749#section-4.1.2.1

Please note that both of the above scenarios are strictly checked by the FAPI conformance suite from OIDF.

Following the above guidelines in the case these error scenarios, will prevent occurrences of bad customer experience due to errors managed insufficiently.

 

What the research says

” A two to three second delay on the redirections screens, may encourage wider take up without causing irritation as the time delay provides reassurance of the bank’s involvement. This is important to older consumers and the less financially savvy.”  

Click for customer research

Previous

Next