I am developing a hybrid application with the use of Ionic 3 which will communicate with a REST Api service that I will write with the use of Spring Boot.
I am having some difficulties with setting up a proper registration / login mechanism. What I want to achieve is that the user registers on the mobile application, then logs in with his username and password and then whenever he opens the app he will always be logged in (without the need to pass the credentials again) for as long as he does not click the "log out" button.
The way I have tried is that with the help of Spring Secutiry when the user logs in with his credentials he receives a JWT token which is saved on the client side (app side) and then used in the header for each subseqnet request.
The problem that I have with this solution is that I have to setup the JWT expiration date (like 10 days, 30 days) and then, when that time passes, the user will have to enter his credentials again in order to receive a new token. I would like to avoid that. Another issue is that there is no mechanism to invalidate JWT tokens in case there is such a necesity.
Another option would be I think to set the access token validty for like 30 minutes and then receive a new one with the refresh token. This however, requires also the client id and client secret, which again, I don't think are safe for storing in the client application.
What is the best practice for such a case?
Please help and thanks :)
Storage module from Ionic can be helpful.
Idea : First time send authentication request
If data is authenticated save the response in local storage (Basically user data)
If user logs out you can remove the storage.
More information can be found on
Ionic Storage
Related
We have an existing web application we developed and needed to port over to an android application for people in the field. So we have a shell of an android application that just points to the URL and displays it. I want to save the user credentials so if they timeout/close application and re-click the application it will auto log them in always after the first time.
I am looking at SharedPrefrences as other threads here have done, but not sure how to capture the creds from the web input elements. Can I use SharedPrefrences to accomplish this still? If so how do I target that input?
You do NOT save the user credentials. Ever. Saving them means they can be read by malware. And no, encryption can't help as the encryption key would need to be in your app or on your filesystem.
Instead, you have your login API return a token. This token will be sent back to the server with every request (either as a parameter or a cookie). The server will then use this token to look up the user id on the server and figure out who it is. That token can be saved to SharedPreferences. (This is the simplest version, there are more advanced things you can do as well, but this is sufficient).
Why is this safer than storing the password? Because passwords can and frequently are shared between multiple apps, so losing a password can compromise multiple accounts.
BTW, this is also how webapps work. They don't send the username/password with every request, when they login a cookie is saved with a token, and its sent back with every future request.
I am working on a solution to read log files from the GCP for an internal process. However, i am having a difficult time trying to generate an Auth Token for the request to grab the logs needed. This is more of a flow\context question rather than a whats wrong with my code one
The key issues i am having is that i do not want to prompt for web-browser authentication. I want to be able to do this all through API request and have no user interaction. Everywhere i have looked and all implementations i have tried, i am prompt for user interaction in some way and that is just not feasible for this solution.
How can this be achieved?
We do not have IAM enabled, so i cannot generate a JWT token.
I am trying to do this through using a Service Account created using client id and client secret.
I have tried getting a "code" to pass into a request to generate an authorization token, but that has been prompting me for user authorization in the browser which will not work, even when I add the query parameter 'prompt' or 'approval_prompt' to none or force.
I feel like i am missing one crucial piece to be able to achieve this flow and any help/guidance will be greatly appreciated.
There are several ways to authenticate API calls. If you want to do it without user interaction, you will need to use a Service Account (more info here). The process would be the following:
You use the client ID and one private key to create a signed JWT and construct an access-token request in the appropriate format. Your application then sends the token request to the Google OAuth 2.0 Authorization Server, which returns an access token. The application uses the token to access a Google API. When the token expires, the application repeats the process.
For this, you can use Client Libraries or you can do it manually with HTTP requests directly. In the docs there is a guide to do so.
I'm not sure about this issue I have, so maybe you can help me.
I have build a 2-Step Verification for an android app.
User sends his phone number from the app to the server via https
Server sends authentication code back to user via SMS (based on
Twilio/PHP)
User receives the code and can authenticate himself on
the server
At that point I can be sure that the user is the authenticated owner of the smartphone where the code has been sent.
If the user now restarts his phone and his app afterwards, how can I ensure that this user is still the same authenticated user?
Do I have to send some kind of credentials to the server each time based on the authentication code? Is this a safe and proper way to do this?
Thank you and best regards!
Dopser
A token number can be generated (similar to a cookie) which is stored both on the phone as well as the server database. The token number can be the verification code too, if you want to reduce the hassle of keeping track of another number.
You can store this token on your device using sharedpreferences or sqlite database, etc
Storage options on Android
On every onCreate() instance you can check if both the tokens match.
This way you can solve your issue.
You can do the same for all consequent activities.
The user should send the access token on each request.
You might need to consider the OAuth flow because your flow can be map to an OAuth token authentication. See here http://oauth.net/2/
You need to think about token/code validity in time as well.
Hope this helps.
I have a mobile application (HTML 5, JavaScript) and a Restful service (Java, Jersey) to cater the mobile application.
Mobile application sign in is handled via a Facebook (Sign in using Facebook account). And currently there is no any security mechanism integrated for the Restful service
So my question is, can I authorize users on the Restful service via the access token retrieved from Facebook, to the mobile application ? To further clarify, if someone has logged into the mobile he/she should be authorized to make requests to the Restful service.
Thanks in advance
Asanka
If the user has authenticated with Facebook and you have the access token with you, you can get the user's facebook profile's public information.
You've got to hit this link - https://graph.facebook.com/me with the access token.
Go ahead, click on the link and see what happens. When you pass a valid access token, profile info will be returned as a JSON object.
(if you FB profile page is = facebook.com/yourname, then just try https://graph.facebook.com/yourname -> you'll be able to see what the data returned looks like.
Now, with the user data returned you can keep an entry in your DB if the user is registered or not, for first time users you can register them.
PS - https://graph.facebook.com/yourname actually returns someone's profile info! I didn't know anyone could keep their profile handle as yourname!!!
PPS - I just checked facebook.com/yourname -> Guess who uses this handle! It's the brazilian defender Roberto Carlos!
I am getting confused.
I have to write an Java Serverapplication for an mobile application. We have our own user management in that application, meaning the user can register and login on our servers without using an OAuth-Provider at all.
Now I want the user to be able to alternativly register via an OAuth Provider.
These are the options I see:
Let the user register local only.
Advantage:
The mobile applications can use the frameworks which are able to login and retrieve an access token for our application
Everything is prestyled by the platform itself, so no GUI work on that
Disadvantage:
How does the server know if the user is logged in or not? One way to figure that out could be to send the access token to the server and let the server start a request to the provider to check if the token is valid or not.
For the registration I have to send all user information which the client got from the provider to our servers.
I dont like this option, cause I would send Userdata and Accesstoken arround. Yes, it would be crypted via https of course, but it just feels wrong.
Let the user register via our servers
The user requests the OAuth provider itself to retreive the code with which you could request the access token.
Send this code to the server and let the server retreive the acess token.
Advantage:
The Server can be sure now, that the user is logged in
The server can retreive all user specific information about the user (such as username etc) from the OAuth provider itself, without sending the arround.
On a login you can repeat this, to make sure that the user is logged in correctly
Disadvantage:
I have to write the OAuth connectors (or using some library for that)
We are not able to use the sdk's, cause they're just returning the actual access token.
We still prefer the first option (register local only)
Because
they WANT to use the sdks. "'cause everyone does it."
If the user would start the application the first time and he was logged in already (with i.e. the FB client), he just has to accept the scopes, we setted up for our application.
Easier to handle the actual login, cause the sdk's where made for it
Does anyone know how to do something like that correctly? Both solutions seem a bit wrong to me.