android - RESTfull web service using oAuth for mobile application -

-

i building application consists of 2 main parts:

  1. web application rest api.
  2. mobile application(android, iphone).

web application has database stores data users (like posts, events , similar).
mobile application uses web application's rest api access data, need kind of authentication (user must authenticate in order access/modify data).

i know done in such way mobile application provides username , password in each request towards web api, , web application authenticates username , password against database before serving request.
however, use oauth (so user can login using google, facebook, ...) , things complicated, , not sure best way this.

my first idea: mobile app sends oauth provider (for example facebook) credentials (username , password) web app, authenticates them against oauth provider. realized not ok because means user has trust site not abuse given credentials, not way done. not good

my second idea: mobile app uses web application api tell web app wants authenticate against oauth provider p. web application redirects provider p user inputs credentials. after provider p redirects web application user logged in , json successful login sent mobile app. great if not part user has input credentials manually. implemented solution , problem that, after mobile app accesses web app api json not returned first redirects done , messes up. thinking using webview inside mobile app, don't know how return webview when json sent. not sure if should pursue idea further or wrong way of doing it? maybe if problems solved

my third idea: mobile app authenticates directly against oauth provider p. if successful mobile app sends requests web app containing user information (for example userid, or user password) web app knows user is. means web app has trust mobile app given user authenticated. means web app needs sure api accessed mobile app. hardcoding special password(secret) in mobile app sent each request prove request sent mobile app.
bad side of approach have implement mobile app authentication against oauth provider each combination of (mobile os, oauth provider). not sure how secure it. think way go, improve/change? have feeling missing something. maybe good, has many work do

please tell me idea best , if there way improve them, thanks

after further research , talking of colleagues decided best option go second idea. decided handle redirects using webview (which exists both on iphone , android). webview configure in such way automatically exits when user redirected specific url on web app returns json.
decided best idea because way have implement/configure webview on mobile app while oauth logic done on web app means there less code repetition among mobile apps (android, iphone) , more extendible (i have modify 1 web app, not 2 or 3 mobile apps).


Comments

Post a Comment

Popular posts from this blog

SVG stroke-linecap doesn't work for circles in Firefox? -

-
i've got problem svg stroke-linecap attribute. i've got circular progress bar in angularjs , set outer circle (blue one) have rounded "ends". @ fiddle . <svg ... height="130" width="130"> <!-- ngif: background --> <circle ... ng-if="background" fill="#fff" class="ng-scope" stroke-width="13" stroke="#cc3399" r="57.5" cy="65" cx="65" stroke-linecap="round" /> <!-- end ngif: background --> <circle ... fill="none" stroke-dashoffset="36.12831551628261" stroke-dasharray="361.28315516282623" stroke-width="13" stroke="#432db3" stroke-linecap="round" r="57.5" cy="65" cx="65" transform="rotate(-89.9, 65, 65)" /> </svg> how can that? ...
Read more

routes - Laravel 4 Wildcard Routing to Different Controllers -

-
realizing i'm going take beating this, have several questions "best practices" when constructing laravel route. do laravel routes run "first come first serve" top bottom? if route found, pass control controller (or perform action) , terminate? i have part of application acts url shortner. so, route looks this: route::get('/{id}', array('as' => 'home.text', 'uses' => 'homecontroller@text'), function($id){ //make sure id exists before pushing controller. if (storage::where('shortcode','=', $id)->count() > 0) { // route found } }); how can improved? one, i'm not sure how pass processing on controller conditionally.. sort of controller::make() ..? 3) there better way in laravel check if record exists versus doing mode::where('column','=','value')->count() 4) have legacy urls http://url.com/?...
Read more

cross browser - XSLT namespace-alias Not Working in Firefox or Chrome -

-
i transforming xhtml xhtml, need xslt stylesheet part of resulting document (the stylesheet contained in <script type"text/template"> element. using the xsl:namespace-alias instruction, works fine in ie, fails in both chrome , firefox. here relevant code: <xsl:output doctype-system="about:legacy-compat" omit-xml-declaration="yes" indent="yes" method="html" media-type="application/xhml" encoding="utf-8"/> <xsl:namespace-alias stylesheet-prefix="wxsl" result-prefix="xsl" /> <xsl:template match="head"> <!-- code omitted clarity --> <script type="text/template"> <wxsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/xsl/transform" xmlns="http://www.w3.org/1999/xhtml" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:eli="local"> ...
Read more