Originally when we built the mobile app Apple offered seamless embedding of Safari in mobile apps. All was good, you could log in to Safari, and magically with one click have the application authenticated. However, fast forward a few years and Apple released iOS 11. Sadly, this broke “shared cooki…

Does this also solve my problem? [画像] Passwordless signin via link generated by api feature Is it possible? I didn’t see this feature in api. I saw that passwordless signin via email link is already planned. Maybe this feature would also be possible? Use-case: users of …

This sounds like a great improvement - getting set up with the app is a pretty frustrating process right now! [画像] sam: one time password… stored in redis I had to read through this spec twice before I realised you weren’t talking about two-factor “one time passwords”. Is there a reason for …

[画像] david: I had to read through this spec twice before I realised you weren’t talking about two-factor “one time passwords”. Is there a reason for this terminology? Yeah we can use the existing token infrastructure here, however I want to make sure that We ship the token encrypted using t…

I have started working on this and have a few things to verify regarding the advanced flow: I don’t think we need to send the public key on every request in SafariViewController. The app currently sends discourse_app=1 which flags the session as coming from a mobile app. If user is logged in, disc…

[画像] pmusaraj: I don’t think we need to send the public key on every request in SafariViewController. The app currently sends discourse_app=1 which flags the session as coming from a mobile app. If user is logged in, discourse_app=1 can be stripped by Ember and the user can continue using the si…

[画像] sam: This can be particularly confusing if https://meta.discourse.com?discourse_app=1 is visited from a random browser on the phone Yes, I see the redirect issue and the confusion it would introduce. Signing a piece of transient data makes sense, I will look into that. Re: ASWebAuthenti…

Re ASWebAuth the only difference is that you stay in the app vs get bounced to Safari? (And pay the price of an extra pop up for not being bounced)

Yes, you stay in the app, and you need to confirm the extra popup. Unlike in Safari, you don’t see an address bar, only a “Cancel” button in the top left corner.

As this feature is in the new release, can I ask how actually it works?

Please wait a few more weeks, while we test the new version of the app

Discourse モバイルアプリの委任認証

開発

pmusaraj (Penar Musaraj) 2019 年 4 月 29 日午後 2:48 15

@hosna last week I updated User API keys specification, which now includes documentation for delegated authentication using a one-time-password. My reply to this question from about 10 days ago might also be useful.

トピック		返信	表示
Authentication Protocol re: App Integration Development	16	2358	2020 年 3 月 31 日
New iOS mobile app beta available for testing Development dev-news	54	4712	2025 年 2 月 25 日
Passwordless signin via link generated by api Feature	15	2163	2019 年 3 月 5 日
Webauthn support Feature rfc	47	6405	2021 年 8 月 30 日
Sign in with Apple Feature	62	10472	2020 年 11 月 27 日

Discourse モバイルアプリの委任認証

関連トピック