Titanium JIRA Archive
Titanium SDK/CLI (TIMOB)

[TIMOB-16699] Windows Hybrid: Force all native calls to pass a security token

GitHub Issuen/a
TypeBug
PriorityHigh
StatusClosed
ResolutionFixed
Resolution Date2014-03-26T06:54:32.000+0000
Affected Version/sn/a
Fix Version/s2014 Sprint 06, 2014 Sprint 06 Tooling, Release 3.3.0
ComponentsWindows Hybrid
Labelsn/a
ReporterChris Barber
AssigneeChris Barber
Created2014-03-25T20:55:33.000+0000
Updated2017-03-16T21:52:05.000+0000

Description

As a security precaution, we need to generate a security token when the app is started and tell the Mobile Web app to pass it along with all requests so that rogue scripts can't access the native API endpoints.

Comments

  1. Chris Barber 2014-03-26

    Master pull request: https://github.com/appcelerator/titanium_mobile/pull/5533 3_2_X_hybrid pull request: https://github.com/appcelerator/titanium_mobile/pull/5534
  2. Chris Barber 2014-07-01

    To test, you need to have a WebView that loads an HTML page that does an XHR call to the socket listener on the native side and try to imitate the Titanium Mobile app. All calls will fail because you don't know the security token.
  3. Lee Morris 2017-03-16

    Closing ticket as the issue has been fixed.

JSON Source