Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.Sign up
Create spec to secure communication with the WebView #320
We need to define for iOS and Android (and hopefully soon UWP) how we secure communications between the WebView and the JXCore instance so random apps on the device can't just connect to localhost and send random commands to our node code. See http://thaliproject.org/SecuringCordovaAndNodeJs/ for details.
@mohlsen I see two choices. One is to update https://github.com/thaliproject/thali/blob/gh-pages/pages/TechnologyInvestigations/SecuringCordovaAndNodeJs.md but perhaps better is to submit a PR to create a new doc in https://github.com/thaliproject/thali/tree/gh-pages/pages/documentation with an actual spec.
@yaronyg please see below the document that captures the investigation results available so far and detail the next steps necessary to find a suitable solution to the issue.
As of today, we've evaluated the potential approaches outlined in Thali documentation:
The solutions 1-3 all have potential issues (including, but not limited to those described in Thali documentation), therefore we believe that proceeding with solution 4 TLS mutual authentication - is the most promising. This approach should work as follows:
Each of these steps has a number of open issues, which are described below.
Further steps necessary
In order to provide a definite recommendation on a solution, we need to continue investigation of the applicability of TLS mutual authentication approach to JXcore to WebView paring process and create an actual proof of concept. This will involve covering the following points:
How to secure communication for a Cordova-based application between a client side and an internal server based on JXCore
Lets assume that we build a hybrid application based on the most popular framework:
How about using HTTPS?
You may ask why not just use the HTTPS protocol? It seems that it should be the preferred solution!
Yes it should, but it would require generating a self-signed certificate for the internal HTTPS server.
So, is there any other solution to meet our needs?
HTTP, SALTI-Admin and JXCore bridge
It turns out that the solution may be provided by the SALTI-Admin library.
The library allows you to generate a simple token and provides mechanism (implemented as Express Middleware)
A simple implementation on the internal server side may look like this:
For now all the requests must have an appropriate authorization token passed in
But how can we provide the token to the client side in a secure way?
The solution may be JXCore bridge. So we have to register a function on the server side like this:
And now we can implement an appropriate function on the client side by using Cordova JXcore Plugin:
If you use AngularJs, you can implement it as a service (that is a singleton), like this:
Since the client side is now able to get a valid SALTI token, the only thing left to do is to pass the token to
But what if we also want to use PouchDB?
Then the implementation on the server side may look like this:
And on the client side we need to configure
In the examples presented above we use the same SALTI token for several resources (just for the purposes of this case
We also should remember that our internal server should be protected from being accessed via HTTP by any device except
For the second case we can verify whether
It should be noted that the presented solution doesn't protect from some "bad" application that can run on the same