JavaScript is required to use Bungie.net

#Authentication

originally posted in:BungieNetPlatform
9/8/2015 3:42:01 PM
5

Provider Authentication in WebViews and InAppBrowser

I'm working on a companion app using Ionic (AngularJS on top of Cordova, seemingly). I'm pretty new to the framework so there are probably things I don't fully grasp just yet. However, I am having a good deal of trouble authenticating. I've seen a ton of server-side authentication examples, but I want to steer clear of them, as I don't want to request and handle ANY credentials on my end. As I look for a solution here, I may explore setting up a quick PSN auth to test with my own account because I'm pretty blocked by authentication at this point. My current workflow consists of using Cordova InAppBrowser to open up an authentication dialog and try to grab the cookies stored in the browser after a successful authentication attempt. At this point, here's what I've got: 1) Open a visible window for the auth provider (PSN: https://www.bungie.net/en/User/SignIn/Psnid?bru=%252f) 2) Allow user to authenticate, let the redirects happen. 3) Open up the Bungie account page (I've tried with the signin link again as well), and run JS on loadstop (Cordova event) on that page to fetch cookies using "document.cookie" For what should be pretty immediately apparent reasons, I'm not getting some of the more important cookies, since they're not returned as part of the response. I get the bungled, bungleloc, and some others but am missing bungleatk. I can't seem to catch the cookies set in one of the redirects (it looks like the missing bungle* cookies are set in a call to Bungie from a PSN redirect with code=XXXX. Has anyone used a similar approach to authenticate, and how have you gotten around the limited ability to fetch cookies using a cross-platform app builder? Are there any thoughts on how to handle the authentication using just WebViews or Cordovas InAppBrowser?
English
#Authentication

Posting in language:

 

Play nice. Take a minute to review our Code of Conduct before submitting your post. Cancel Edit Create Fireteam Post

View Entire Topic
  • The reason you can't get particular cookies is both a good and bad thing. When they're set, cookies can [url=https://www.owasp.org/index.php/HttpOnly]have a flag enabled[/url] which prevents them from being accessible from client-side script, even though they continue to be managed properly by the browser. If I remember correctly, you also can't try anything tricky to bypass it either, like grabbing the raw cookie header values because they're filtered before your script can touch them. So the good news is that the policies are working correctly. The bad news is that unless you can get privileged access to cookies, there's not really anything you can do.

    Posting in language:

     

    Play nice. Take a minute to review our Code of Conduct before submitting your post. Cancel Edit Create Fireteam Post

You are not allowed to view this content.
;
preload icon
preload icon
preload icon