Wednesday, July 03, 2013

WinJS Authentication

In windows store app there will be a login prompt when a network resource request requires authentication. As for HTML/JavaScript implementation, the login prompt only pops up once, and the authentication token is cached and used by subsequent requests. You can provide the user name and password in WinJS.xhr request to avoid the login popup:

    WinJS.xhr({user: "domain\\user", password: "mypassowrd", url: ...}).done(...);
This actually works fine with Basic, Digest and Integrated Windows Authentications, but be aware that such implementation is hard to maintain and not secure at all, and it's quite easy for end users to find out such secret, refer to this post.

In general we should not hard-code any credentials inside a mobile app. When authentication is required, building a custom login form will be more secure and result in better user experience. For some general services, such as user behavior tracking service, you may simply enable the anonymous access in your server.

In an Intranet environment when the client machine is inside a windows domain, the default windows credential can be used to auto-authenticate to the server if the "Enterprise Authentication" Capabilities option is enabled, but I haven't had a chance to test it yet. In most cases we don't need such setting because of the distribution nature of Windows 8 store app.

Microsoft also provides Windows.Security.Authentication.OnlineId API to authenticate the user with Microsoft accounts, a.k.a Windows Live Connects. How about the OAuth authentication? It's implemented inside WebAuthenticationBroker API. Microsoft has some code examples to show how to do OAuth with Facebook, Google, Twitter in WinJS. In my previous post I built a Twitter OAuth 1.0 proxy page using C#, which retrieves tweets directly using hard-coded OAuth keys and tokens. That's not the standard way of using OAuth. It's not trivial to do similar stuff in WinJS. Luckly some people has already done the work and put it at github with 400+ line of JavaScript code. Simply download and include the module and you are ready to go.