appdotnet / adnlogin-sdk-ios Goto Github PK

The method:

- (BOOL)openURL:(NSURL *)url sourceApplication:(NSString *)sourceApplication annotation:(id)annotation

is called by the client app's UIApplicationDelegate whenever the client app is launched via its URL scheme. If ADNLogin doesn't handle a given URL scheme it NSLog an error:

Couldn't open URL

This error is logged whenever ADNLogin cannot handle an URL, even if the URL is a valid URL scheme for the client app.

I assume the following should be added to the README:

Identifier and URL scheme should be considered secret. Anybody knowing these two and your App Identifier can create requests seeming to originate from your App,

I'm not totally sure about this. To my understanding the combination of Identifier (net.app.client.abx), URL scheme (adn123) and App Identifier (com.example.myapp) is used to identify and authenticate the app. I assume that at least for AdHoc builds an attacker can have complete control about the App Identifier (com.example.myapp) and so can impersonate an existing app.

This should not be considered an security vulnerability because given enough resources any client side secrets can be extracted although FailPlay makes it somewhat harder.
But Identifier and URL scheme should be considered secret by the developer and thus not published. See http://developers.app.net/docs/authentication/flows/app-access-token/ for documentation about this in a different context.

Than again, I might just be wrong about what is happening there.

If you download the project as it is and run it on the iOS 5.1 simulator you have a crash due to Auto Layout. The solution is to turn of Auto Layout in all the .xib files. Given the potential hassle of merging xib files I think it's better if I don't send a pull request.

Since using this ties me into authenticating via the app in the app store, and we're unable to install 3rd party apps in the simulator, is there any recommended way to allow us to test (or bypass authentication) when testing our apps within the simulator?