CODEWITHSUNDEEP
javascriptsecurityoutlook-web-addins
nforss
nforss

Reputation: 1258

How to store credentials in an Outlook Add-in

I'm looking for the correct, secure way to store credentials for a third party API in an Outlook add-in. This overview of the different storage options only says not to store credentials in Settings, but not where to put them, so I assumed the RoamingSettings would be okay. Then I ran into this page with information about RoamingSettings, where it says that is not the right location either.

The question then becomes: What is the right place? Should I build my own storage solution and store/encrypt the credentials in a file or cookie? That does not feel very secure either, since we are talking about what is basically a web app running in an Iframe.

Upvotes: 11

Views: 4324

Answers (2)

Benoit Patra
Benoit Patra

Reputation: 4545

I assume you cannot implement another authorization scheme (token based, cookies etc.) for your API and you are stuck with Basic Authentication and its issues. If you are using ASP.NET, with all the samples available it could be very easy to add another authentication scheme that is more adapted to web clients (such as Office web add-ins).

Having said that, for me your best option is to use HTML5 storage or cookie storage (if not implemented by browser) to store your credentials.

The fact that the app is iFramed is not really a big deal. Those storages (HTML5: sessionStorage/localStorage) rely on domains separation which means that the storage slots where you will put the credentials will not be be visible by other apps, even those living on the parent iFrame.

You may also consider the fact that you may serve the web add-ins and the apis from the same domain. They are both web applications!

Upvotes: 3

Dmitry Streblechenko
Dmitry Streblechenko

Reputation: 66245

You can do what Outlook itself does for its POP3/SMTP/IMAP4 passwords - use CredRead / CredWrite Windows API functions. The data can only be decrypted under the local Windows account used to encrypt the data, so it cannot be take to a different machine and decrypted.

I don't think you can access these functions from JavaScript. This is for an OWA addin, not the Outlook application, is it?

Upvotes: 0

Related Questions