Login with phone and asp.net mvc 4

Question

I am developing an organizer with tasks for the user that are stored and managed through the website. For the website, I am using ASP.NET MVC 4 and backbone.js. Now I want to create a mobile application using PhoneGap. The user will be able to log in / register, and then be able to manage their tasks using their phone / tablet on the go. So my problem is that I don’t know how to log in, and then how to get jobs from the server.

Now I am using backbone.js and I have api on the server that manages the tasks. My idea was to use only the same code (only html, css, js) from ASP.NET MVC, and it should work easily, but for this api the user should be registered, and for this, simple membership and web security that is used in the backend, which I’m not going to use with the mobile version, and I'm not sure how the user will log in.

Another idea was to check the user credentials (with an AJAX request to the server, which can tell if the user has entered valid login information) to have their user ID on the phone (local storage or something like that), and then use api on a server that will not need a user to log into the system, and it will manage the tasks of the user (for which I pass the user ID). But I think it will be a huge security hole, because everyone can change tasks only with a user ID. I already found an example of logging in from Raymond Camden ( See here ), this idea may help, but this is only part of the logging in (and only logging in to the device, but the security issue that I talked about concerns me)

Therefore, I would be grateful if you would give me some ideas on how to implement login on the device and how to get data for the user from the server. I would really appreciate even conceptual ideas.

Answer 1

You can create a web API by creating a web API controller in your controllers folder to expose the code on the server side. For authentication, you can use basic HTTP authentication by specifying the user credentials in the authorization header. Now in the web API message handler you need to read the user credentials and allow the user. Here is a good article on this topic. . One of the disadvantages of using basic authentication is that for each request you need to click on your AD database to authorize the user. To avoid this, you can create a secure token after the user is authenticated for the first time, and then pass it to the client so that the client uses this secure token for all future requests. if performance is not important to you, basic authentication will be performed.

Answer 2

I was in the same situation. To solve the problem, I used the SessionTecture framework tag. It allows you to authenticate once using, for example, Basic Authentication, then you can request a token, which can be transmitted among requests, and can be stored in your local storage. Thus, you will not need to store the user and password in unsafe places and will not authenticate everyone for each request.