Passing a generated nonce string in app to app authentication flow #63
Conversation
|
Hi @sowmiya, thanks for the pull request. Before we can merge it, we need you to sign our Contributor License Agreement. You can do so electronically here: http://opensource.box.com/cla Once you have signed, just add a comment to this pull request saying, "CLA signed". Thanks! |
| * Returns the randomly generated nonce used to prevent spoofing attack during login | ||
| * @return generated nonce | ||
| */ | ||
| - (NSString *)nonce; |
There was a problem hiding this comment.
Any reason that we should not expose this in the header? (in other words, in your thought process what were the pros and cons, or does this just make sense as-is?)
There was a problem hiding this comment.
As far as I can tell, we are not allowing users to modify this string by exposing it in the header. Also once generated, it remains the same so we wont run into any inconsistency in value.
|
+2 LGTM, Glad it was just the one step that was missing in the chain. |
Passing a generated nonce string in app to app authentication flow
with box app