ProcessWire + Ionic : Handling User Authentication & Sessions

[Vineet Sawant]

Hi,

I'm working on a simple Ionic app which is going to use ProcessWire as the backend.

This app allows people to upload images and then like/comment on them. It's a lot like a stripped down imgur app.

I've set up some basic services such as register, login & reset password.

There are a couple of things I am doubtful about.

1. How do I get user's unique session Id once he's successfully authenticated through AngularJS's http post request?

I'm currently using following code:

$sessions = $session->getAll();
$session_id = $session->_user["fingerprint"];

But I'm not sure if that's the right way to do it. I'm not even sure if that's the session id. I know there's something called SessionCSRF["name"], I tried that.

I'm sending session_id as response to http post request. Then I'm using that session id to check if user is authenticated for his/her further actions such as commenting/liking/posting etc.

2. Now that I've got the session id, how do I identify the user based on the given session id? or should I send user ID back to PW everytime user is performing any action?

Is it possible to identify user just based on the session fingerprint that I'm giving back to the app?

Among other things I'm considering are keeping a device id on the server for each user, so as to gain better control over user's sessions.

I can log out all the devices linked at once etc. 

I'd really love to hear from you guys how you'd plan to do this app. I'm experienced with PW but not very much with AngularJS.

Thank you.

[Vineet Sawant]

Wow, still no response. I must have asked either a really tough or really stupid question.

[LostKobrakai]

Or there are just not many people into the topic. The only thing I can provide you with is that apps most often do not use session authentication, but rather oauth, which I suspect does have a reason. 

[Wanze]

Since Ionic is on top of Angular, here's a good article: https://auth0.com/blog/2014/01/07/angularjs-authentication-with-cookies-vs-token/