iframe navigation not authenticated on iOS

[gfox1984]

After successfully authenticating to a website using the plugin API, you are not able to navigate to the same website in an iframe on iOS (tested with iOS 9). Not sure whether it's a cookie issue...

This bug does not occur on Android.

[amitkumar3968]

I think, after successful authentication, you have to hit your url through inappbrowser in ios.

[gfox1984]

Actually I just used Fiddler to intercept the request. I can see that the required cookies are not set when I open the website in the iframe after authenticating.

[amitkumar3968]

so, whats ur issue ?

[gfox1984]

The user is not authenticated in the frame because the authentication cookies are not set in the frame.

More precisely, the issue occurs with a site that uses a STS. After the STS has authenticated the user, the server responds with a HTML page that contains a form with the user claims. That form normally gets posted back to the website using JavaScript, which then sets the required cookies.

This works well in Safari on iOS. It doesn't work with the plugin on the app. The reason I believe is that the STS requires that the HTML response is actually run to complete the authentication.

[amitkumar3968]

@gfox1984 , what i implemented was, having a http url having ntlm authentication protection in it, so by using this plugin, after successful authentication, i opened the url via inappbrowser in ios app, and it worked.

Test url for http authentication. http://httpbin.org/basic-auth/user/passwd

So, after authDialog.authenticate , you should try to open your STS url again. it will not automatically open the url for us.

Try and let me know, if possible can you provide the STS url for testing.

[pallaviMN]

@gfox1984 , i am also facing same issue, can you please send me how to implement this

[gfox1984]

@pallaviMN After authenticating, simply navigate to your site in the frame and it should work. We actually had a bug in our STS which was crashing due to bad cookies.

[pallaviMN]

i wanted to know, how to call the plugin in android & its not calling "willSendRequestForAuthenticationChallenge" in iOS

[gfox1984]

@pallaviMN on Android you cannot and you don't need to call the "authDialog.authenticate". When first accessing a page which requires Basic/Digest/NTML authentication, the authentication popup will automatically show. I'm not sure about "willSendRequestForAuthenticationChallenge" in iOS.

PS: beware than iOS caches your credentials. So if you've entered them once, you won't be able to reenter them and go through authentication. This could be why you seem not to be re-authenticating in your app. To force reauthentication, you can use the Phonegap-Cookies-Plugin to clear the cookies, combined with the undocumented "authDialog.logout()" method. Below is an example that ensures a clean logout:

                // Clear authentication settings
                if (typeof authDialog !== "undefined")
                    authDialog.logout();
                // Clear any residual cookies
                window.cookies.clear(function () {
                    // Redirect to the login page                    
                    })
                });

[sDaniel]

There is no logout method for this version of the plugin. Some people have worked on stuff like that though:

https://github.com/pcjonkman/cordova-plugin-auth-dialog/commit/bb7a1c92c1eba7bf983d97fe00bb89ca0efa5ac3

https://github.com/dually8/cordova-plugin-auth-dialog/commit/ec66bc958f283cac1c39ee85db40b80469a83590