1

I am working on iPhone application which have login form to access application functionality same as website. now i want to add one button in iphone application that redirects user in to website in safari browser with successfully login.

After success login in to iPhone application, user want to check website in browser so i just need to add functionality that user can directly login in his account and redirect on particular page.

i have some basic idea for that we can do with encrypted username and password with url. like http://xyz.com/login/username=abc&password=abc but i know that its not secure way to pass username and password with url.

So please suggest me any other way if possible.

Any idea or alternative that how to implement this.

Thanks in advance.

Paras Gandhi
  • 823
  • 1
  • 13
  • 28
  • 1
    The similar kind of question is asked http://stackoverflow.com/questions/1571336/sending-post-data-from-iphone-over-ssl-https May help you... – Krunal Doshi Nov 23 '11 at 07:55
  • i checked url that you suggested and i have question with that like sending POST data gives me yes or no response based on success but i want to redirect a page in safari(native) browser in iPad with login. – Paras Gandhi Nov 23 '11 at 08:43

2 Answers2

0

There are a few ways to do it. Any time you send password information over the Internet you want it to be encrypted over SSL. This will require an SSL Certificate for your web server though and it's not always possible.

You can also encrypt the username and password yourself in a way that only your web server will know how to decrypt. So the username "foo" could be turned into "oof" and the password "bar" could be turned into "rab". That way if someone intercepted your requests, they couldn't know what the username and password were without knowing how you changed them.

Randall
  • 14,691
  • 7
  • 40
  • 60
0

Why not pass the session id?

Here's what I mean: When you log in to a web site, typically you're assigned (or already have) a "session cookie" which essentially tells the server "This visitor has session ID 'XYZ'", and allows it to retrieve the server side information stored for that user (like who they are, that they authenticated, or whatever else you store in the session store.

One of the easier ways of moving to/from applications is to make sure that all logins generate a server side session, and provide a script which will overwrite the user's session cookie and redirect them to the proper page.

session_restore.php?sessionId=12345&redirect=HOME

The doubters here will argue that providing such a script is tenement to a security breach, but I would argue that all of this information is stored client side already, and can be accomplished without the server's intervention anyway. (session hijacking plugins for popular web sites exist for firefox that will grab session IDs from wireless networks - no technical skill needed)

Doing it this way just makes the process friendlier to the user, and if your site provides SSH access (which you really should be doing anyway) then the risk is very minimal.

SplinterReality
  • 3,400
  • 1
  • 23
  • 45