CODEWITHSUNDEEP
iphoneauthenticationpasswordsuniqueidentifier
TerryB
TerryB

Reputation: 629

iPhone - Web Access Authentication

I am building a secure app for our exec's... here is my setup. It's a somewhat Macgyver approach, but bear with me :)

  1. There are only 10 users, I have a record of each uniqueIdentifier on my backend in a database table. (This is internal only for our users, so I don't believe I am breaking the public user registration rule mentioned in the API docs)
  2. Through adhoc distribution I install my app on all 10 devices
  3. My app is simply composed of a UIWebView.
  4. When the app starts it does a POST to our https site sending the uniqueIdentifier. (Thanks to this answer)
  5. The server page that recieves the POST, checks the uniqueIdentifier and if found sets a session cookie that automatically logs them into the site.
  6. This way the user doesn't have to enter in their credentials every time.

So what do you think, is there a security hole with this?

Thanks

Upvotes: 0

Views: 787

Answers (1)

Alex Reynolds
Alex Reynolds

Reputation: 96937

Since you are storing all your unique IDs in the application, each of which is a credential that unlocks access, all I need to do is steal one of your employee's phones or otherwise get a copy of the application to look for those keys.

If you need to store credentials on the phone, use the iPhone's Keychain.

Upvotes: 2

Related Questions