I am using CouchDB to authenticate users for my app, which is essentially just a front end for a CouchDB database, so I am using the API to authenticate users, logically, this code
httpget(http://wrongusername:wrongpassword#mycouch.com:5984) //not my actual code
should come back with the response
{"error":"unauthorized","reason":"Name or password is incorrect."}
as it does when I cURL the same URL. But instead, no matter what I put in as the username and password it returns
{"couchdb":"Welcome","version":"1.2.0"}
And I know I'm not somehow storing a valid URI or that response in the code because I've changed the parameters of HttpGET to return _all_docs, and it has returned all the documents, which a normal user shouldn't be able to to do. I have not modified any of the configuration files and the login is not stored anywhere in the database
Are you sure you are hitting the same CouchDB instance that you have set up the users with? Clients, not even Android, have a way of bypassing authentication.
Couchdb uses session cookies for authentication, maybe your http client authorized to couchdb before and keeps the cookie around?
Another thing I can think of: unless you set require_valid_user to true, couchdb only restricts access to individual databases, which would explain the "welcome" message on /.
Related
How can I safely pass a user's email and password from an Android app over to my web server's REST API for authentication?
Would it be safe to create a POST request to a route, like:
http://www.website.com/user/login
Are there other ways to do it? Safer ways? What safety concerns should I know about?
Sending the password should only be a "login action". Obviously, this login call must be done via https in order to be safer.
The problem is that a mechanism based on a password attached to every request is not safe enough.
The two main methods
Via cookies: You interchange a cookie between client and server. You obviously have to handle the authentiacion in server to validate the request. Classic way.
Via tokens (OAuth2 way): You interchange a refresh token (long duration, maybe days, months... it's customizable) and an authentication token (temporary and refreshed with the refresh token). You have also to handle this on server (to set scopes and times,validation etc.).
I'm always thinking in a password for an user/session. Don't store "masters passwords" for services in your APK!! Never!! APK has no secrets, they can be easily decompiled.
I hope this would help you ;)
How can I use cookies to authenticate a user in PhoneGap for Android?
The server will send a cookie containing a session ID. As part of each future AJAX request to the server that cookie must get sent to authenticate the user. I don't have access to the server, so I can't change how it works.
So, I have to use cookies. I can't use local storage or anything like that, unless it behaves exactly like a browser would if a server were to send a "Set-Cookie" header.
How do I do this?
Using local cookies with Cordova isn't possible, unless you can store them server-side. In your case, you can make use of local-storage, for easy values/flags/strings, or if you want a relational database, use WebSQL.
Local Storage:
http://docs.phonegap.com/en/4.0.0/cordova_storage_storage.md.html
WebSQL: http://dev.w3.org/html5/webdatabase/
I would recommend WebSQL above others like IndexdDb because it is most wideley supported for mobile devices. See following link: http://caniuse.com/#feat=sql-storage
(I'm asking this partly for learning purposes, I realize what I'm trying to do might be entirely wrong!)
I have a php file on my website that handles log in and sets a cookie for the user if log in is successful. if setcookie() fails, I error out instead of displaying the rest of the page.
When I try to access this page using my android app (which uses HttpURLConnection with POST), the setcookie() fails. I'm guessing this is because the client isn't a browser and can't handle cookies.
so first of all, is there away for my app to be able to receive cookies from the server and store them? if not, how do you handle maintaining a login session with the user so you dont have to send a username and password, every time you want to access data from the server?
THanks
A couple of notes before the workaround:
The function is called setcookie() not set_cookie()
Android browsers do support cookies afaik, so you probably should look into this further. Perhaps the format of your setcookie call is not valid?
If you can't use cookies, then the workaround is to simulate your own session mechanism by passing your cookie value as a url parameter on every request.
I am very new to writing apps so please bear with me!
I am writing an app that needs to communicate securely with a java server (under my control).
Firstly to login to the server, and then send data back and forth. What is the best way of doing this?
My first thoughts was to communicate to a webpage via ssl with the username and password. e.g. login.php with user=xxx and pass=zzz as posted variable. The site returns a random string and saves it in the database.
If the user then stays logged in, this string is saved on the app. This is then sent with every communication. e.g. set_temp.php with string=123456 and temp=20
This seemed easiest to complete, and I have done most of this.
Alternatively, my other thoughts was to go through a sockets approach and commumicate with the Java server directly. Would this be more secure? Is this even possible?
Or are there any other suggestions? How do the big apps like facebook and gmail secure data?
Thanks
Matt
Use SSL protocol. You can create API services on the server and communicate with them. To keep the user logged in use SessionID. Take a look at DefaultHttpClient() class.
I hope this is useful :)
I would use a webservice on your java machine to communicate with. All requests are via HTTPS and you can login the user via the webservice. Also I would add a time limit to the users loggedin session to ensure that he is logged out properly after some time limit.
I want to make a login application in Android.
Requirement of the project is to store user name and password for two days using cookie.
Is it possible to use cookies? If yes, then how? Can you give me the code?
Note: I can't use web view.
As a commenter already said, you aren't supposed to store password (even in encrypted form) in a cookie. What you can store is a session id. When user logs in the application, the application generates a session id for him/her, which will stay valid for two days. In every request that you make to the application, you add the session id as an HTTP header.
You can store the session id and the datetime it was issued in the preferences. When the user needs to make a new request to the application and the session hasn't expired, you can read the stored value.
If you are not looking to integrate this into the browser, then have a go at this.
If you look at the HTTP protocol, you can see that cookies are sent by the client in plain text in the request. This means you should have your application deliver them every time your request a page. This is not valid for local-only cookies, but I don't think that you're interested in these. If you want to set cookies from the server side, you will have to adapt your application to parse the response and look for cookies. (also HTTP protocol)
For a better view of the raw data you need to send or receive, you can monitor your traffic using Wireshark or a similar tool and see how the request/response look like.
I am currently working on a web-service that I need to implement on iPhone and this is my first idea of doing it. I haven't got to implement this yet (my web service is still not done) so there's not much more I can tell you at the moment.
Edit:
A useful page about this might be the Wikipedia HTTP Cookie page located here.
As Reno said, try to avoid storing the password in the cookie. Instead you should let the server generate a sessionID when logged in and let this ID expire on the Server after two days. SO you can login with the username and the sessionID you generated with logging in once.
I you want, you can store that sessionID in the cookie.