Jump to content
anttila

App password to ProcessWire

Recommended Posts

We are developing an App that sends data over the Internet to ProcessWire (POST/JSON). We want password to be protected somehow when sending it, but I should be able to compare it to PW's passwords. We were thinking of using md5 encryption, but PW uses different encryption.

How can I be sure that user has active account when they use the App?

Share this post


Link to post
Share on other sites

You might want to have a look at my REST API tutorial.

It implements basic HTML authentication which is a standard that is quite secure when used over SSL.
If you use that appoach, then you need to to send base64-encoded credentials (username:password) when your App authenticates with PW.
Then on the PW side you need to decode those into username and password. See how this is done in the Rest Helper php
Then do the login attempt with $session->login('username', 'password'); to see whether the credentials are valid.

 

 

 

  • Like 3
  • Thanks 1

Share this post


Link to post
Share on other sites

They don't actually login to the website when they use the API - I just need to know if the password is correct and send confirmation or false. Although, I could use $session->login to check if the credentials are valid. Thanks for help, I'll look into it.

  • Like 1

Share this post


Link to post
Share on other sites
2 hours ago, anttila said:

Although, I could use $session->login to check if the credentials are valid.

Do that. Rely on the built-in mechanisms for user authentication and authorization as much as you can, and you have already eliminated three quarters of the security pitfalls of writing a client app. Let your app deal with regular http status codes like 401 instead of custom status messages and you have another ten percent.

:)

  • Like 2

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

  • Similar Content

    • By Robin S
      Password Generator
      Adds a password generator to InputfieldPassword.

       
      Usage
      Install the Password Generator module.
      Now any InputfieldPassword has a password generation feature. The settings for the generator are taken automatically from the settings* of the password field.
      *Settings not supported by the generator:
      Complexify: but generated passwords should still satisfy complexify settings in the recommended range. Banned words: but the generated passwords are random strings so actual words are unlikely to occur.  
      https://modules.processwire.com/modules/password-generator/
      https://github.com/Toutouwai/PasswordGenerator
    • By AndZyk
      Hello,
      can somebody tell me, if it is possible to get the clear password of an InputfieldPassword inside a module, before it is encrypted?
      I have made a custom module which sets the password of an Auth0User after the hook publishReady with a random generated password. When I try to get a clear password from a InputfieldPassword in this hook, it is of course already encrypted (which is of course good). But is there a hook before the encryption, so I could get it one time to send it to Auth0?
      If there is not such thing, could be another possibility to add a jQuery script to get the value directly from the DOM and save it somewhere temporarily?
      I know this might be an unusual question, but I would appreciate any feedback. 
      Regards, Andreas
    • By Slav
      Hey guys... Ok so I have a problem with a registration form password inputfield... The problem is that InputfieldPassword.js and InputfieldPassword.css are not loaded/fired. Or I dont even know exactly what is happening... Im pretty new to processwire and the website was not created by me so Im trying to figure out what has been done and how processwire works. Anyway this is how the form looks right now:

      ...and as you can see the styling is off (password validation check in particular)... this is what I see when page is loaded (without adding any input)... it looks like js and css files from wire/modules/Inputfield/InputfieldPassword are not firing... I dont know how it is supposed to work exactly so I dont even know where to start.
      Maybe someone has had similar problem and know an easy fix or can navigate me to what could cause this situation in PW.
      Oh by the way this problem occured when upgrading the PW version (current version 3.0.65)... everything else is ok... this is the only problem that has been found after upgrade...
      Appreciate all the help!
      Cheers!
    • By jen
      Yesterday we somehow lost access to all current admin, superuser/passwords to processwire.  We tried using the reset password form and nothing was sent.  We began noticing some of the menu buttons went missing as well as some photos.  Any suggestions how to resolve the login issue?
       
       
×
×
  • Create New...