Password authentication, Kasper's API

jamesmercury

"Does this work for native applications, non-web scenarios, or third-party products?No. jsConnect is purely a web-based SSO workflow for your existing login system. We have separate products for popular third-party platforms and non-web scenarios."

Hello. The above was culled from the official docs. I have created an android app for my forum with users authenticating with their usernames and emails.

The session based method(https://github.com/kasperisager/vanilla-api/wiki/Authentication#session-based) looks like a winner but it's web based.

Is there a way for them to login with username/email with their passwords perhaps by getting a json response token?

Much thanks.

hgtonight

Are you looking to only use the API?

Or are you looking to load the existing views into your app?

jamesmercury

I'm using the API. Endpoints that require authentication require only a users

1.username
2.email.

The thing is, usernames and emails can easily be gotten. Basically, my question is how can I get endpoints that need authentication to require

1.username/email
2.password

akin to the web based login?
Thanks.

Attached is a screenshot of my login screen. Requiring username and email.

x00

What you mean web based?

If they can communicate by http they can log in.

Is this a client app? if so then there is no need proxy the request. Just hold their session cookies. Send the credential to /entry/signin as normal http POST. Once they are logged in you can use the API.

x00

you can fetch the form with entry/signin?DeliveryType=VIEW with has the transient key included, you could include this in a browser object.

if you change the action to entry/signin.json and make asymmetric to capture if the login is incorrect the you will get Code and Exception attributes. if you do get those you should be logged in.

You can verify this with /profile.json

This will only persist with session handling.

However many of the html5 based app libraries effectively allow to over style web pages anyway, so you can have a normal login.

jamesmercury

@x00 much thanks for your assistance. Yes it is a client app (Cordova for Android to be exact).

Are you saying I can post login credentials to 'entry/signin'? It's not one of the endpoints of the API...(https://github.com/kasperisager/vanilla-
api/wiki/Endpoints)

The way many auth services work eg Facebook is once correct credentials are posted a token is sent to the client. This token is then sent along with future post/get request

x00

You can use what every authentication you like. But it would very foolish to use the signature based method, which is for server to server. That would hand over full control.

Kasper's API clearly mentions session authentication is for client <-> server communication.

https://github.com/kasperisager/vanilla-api/wiki/Authentication

[quote]This method is in fact just the default Vanilla authentication. It is semi-stateless in the sense that when authenticating with the server, each client gets assigned a cookie which initiates a session. If a client accesses the API with a valid session, he or she can freely interface with Vanilla using the API, only restricted by their permissions.

Should you wish to use the session based authentication method, you'll need to use one of the many SSO solutions available for Vanilla to authenticate users from within your application.[/quote]

You can use one of the authentication methods like Google Plus, you still need session cookies.

Cookies are not that different from tokens, in that they also get sent with each request. In fact it is one way of sending a token.

cordova has:
https://cordova.apache.org/docs/en/3.1.0/cordova/inappbrowser/inappbrowser.html

session ideas:
http://justbuildsomething.com/cordova-and-express-session/

Current versions may be supporting session without this workaround, you need to check.

x00

Are you doing

client <-> api/vanilla

or

client <-> server <-> api/vanilla

As you could go token authentication with middleware that connects with some SSO. Personally I would use session based as less thing to go wrong, it is a ready solution, with is less overhead, you benefit from security updates.

x00

Also you could create a token based endpoint plugin for vanilla as an authentication method. I wouldn't though.