C＃使用桌面应用程序自动登录网站

Question

I have a website in PHP Laravel 5.2 .

I want to create a desktop application (something like drop-box application for windows) using C# , in which there will be a button "Open web", clicking which the logged-in user (in desktop app) should get logged in to the web-site without asking any credentials.

In web-site, I am using api_token based authentication.

There is a possible way I can make an end-point in web-site to check the token an make user logged in if correct, but I think it is less secure.

I've checked request-response log in fiddler for drop-box "Open dropbox.com" button, it does not sets any token in request.

The question is how can I achieve it?

Answer 1

One way would do the following:

1. Request a use-once (a nonce) unique code from the server in your desktop application, that refers to the user you want to log in as

2. Open a webbrowser process with an address that contains this use-once code, something like this:

   http://www.your.server.com/the/page/you/want?auth=29874298798724982734

The way Dropbox does this, is to create a temporary html file on disk which contains some javascript code that posts a "form" to a secure page on their server

https://www.dropbox.com/desktop_login

form fields:
    buildno=Dropbox-win-7.4.30
    u=home
    c=en_US
    i=<some number>
    n data-nonce-c=<some large hex string>

Then it spawns a webbrowser process to open this file.

To see this file, use the globe link in your Dropbox app and then hit Esc as soon as the initial web page loads and grab the url which should look like this:

file://C:/users/USERNAME/appdata/local/temp/RANDOM.html

Then open this file to inspect it.