Page 1 of 2

Stackmob oAuth without exposing my private key

Posted: Fri Jul 27, 2012 4:46 pm
by Harish Narasimhan

Stackmob oAuth with username and password.
How do i user Tiggzi to login to Stackmob specific to an user without exposing my private key as given in the example http://help.gotiggr.com/getting-start...


Stackmob oAuth without exposing my private key

Posted: Fri Jul 27, 2012 5:20 pm
by maxkatz

It's not specific to apps built in Tiggzi, it's an issue across the board with HTML5 mobile apps where you can view the source and look at the private keys. If you build a hybrid app, then looking at the keys is not possible any more (well, possible but much more difficult).

We are working on a solution where the keys will be kept on the server - sort of a proxy.


Stackmob oAuth without exposing my private key

Posted: Fri Jul 27, 2012 5:41 pm
by Harish Narasimhan

I am able to authenticate a user on stackmob with just the public key and his user name and password using a rest service
I am not sure how to save that authentication


Stackmob oAuth without exposing my private key

Posted: Fri Jul 27, 2012 5:43 pm
by maxkatz

Save what..?


Stackmob oAuth without exposing my private key

Posted: Fri Jul 27, 2012 6:59 pm
by Harish Narasimhan

A login token maybe. How else do html5 banking apps authenticate?
With the latest changes to stackmob, when i authenticate login id and password it seems to send me back a cookie token in the header


Stackmob oAuth without exposing my private key

Posted: Fri Jul 27, 2012 7:14 pm
by maxkatz

You can save it Local Storage


Stackmob oAuth without exposing my private key

Posted: Fri Jul 27, 2012 7:34 pm
by Harish Narasimhan

Could you help with a sample of that please. Because stackmob gives SDK for Javascript/HTML5 apps. I am not sure how to use it within Tiggzi
http://www.stackmob.com/devcenter/doc...


Stackmob oAuth without exposing my private key

Posted: Fri Jul 27, 2012 8:22 pm
by maxkatz

Although you can use a JavaScript SDK, the concept in Tiggzi is based on using REST APIs directly. This way you can get the powerful mapping feature and more in Tiggzi. That would be my recommendation.


Stackmob oAuth without exposing my private key

Posted: Fri Jul 27, 2012 8:45 pm
by Harish Narasimhan

Absolutely i want to use Tiggzi and that is why we have four people with licenses trying to get our prototype on Tiggzi. Would greatly appreciate if you could help with login authentication using just the public key with login/pwd combination please.


Stackmob oAuth without exposing my private key

Posted: Fri Jul 27, 2012 9:20 pm
by maxkatz

I'm going to ping the guys at StackMob, I don't believe the REST APIs to do this are in the docs...