Re: best practice or keeping sessions alive for several days

2014-08-03 Thread Seung Chan Lim
Are you referring to this link I posted in this thread? https://github.com/shazron/KeychainPlugin https://www.google.com/url?q=https%3A%2F%2Fgithub.com%2Fshazron%2FKeychainPluginsa=Dsntz=1usg=AFQjCNF16EZPfmHR0H3oPaQN9rzhSiXZ1Q I'm trying to figure out if I can set CBLReplication.credential,

Re: best practice or keeping sessions alive for several days

2014-08-02 Thread Seung Chan Lim
Hi Jens, You said: What you do is add an Internet password entry for the base remote URL (https://example.net:4984/db in the example) and realm Couchbase Sync Gateway”. Then you don’t need to put the password (or username, really) in the replication URL anymore. What iOS API do you use to

Re: best practice or keeping sessions alive for several days

2014-07-25 Thread Seung Chan Lim
I'm trying to figure out what exactly add internet password entry translates to for this keychain plugin. Are you referring to this:

Re: best practice or keeping sessions alive for several days

2014-07-25 Thread Jens Alfke
On Jul 25, 2014, at 4:49 PM, Seung Chan Lim djs...@gmail.com wrote: The plugin uses a lower-level API to simply set/get key value pairs for a given service (i.e. just 3 parameters) I’m not familiar with that plugin, only with the Cocoa APIs (NSURLCredential, NSURLProtectionSpace, etc.)

Re: best practice or keeping sessions alive for several days

2014-07-23 Thread Seung Chan Lim
You mean on each and every http request (i.e. push replication), embed the user's id and plain text password in the URL and let SSL encrypt it to lower the possibility of a man-in-the-middle attack? slim On Tuesday, July 22, 2014 5:23:05 PM UTC-4, Jens Alfke wrote: On Jul 22, 2014, at 1:47

Re: best practice or keeping sessions alive for several days

2014-07-23 Thread Jens Alfke
On Jul 23, 2014, at 9:49 AM, Seung Chan Lim djs...@gmail.com wrote: You mean on each and every http request (i.e. push replication), embed the user's id and plain text password in the URL Well, it doesn't go in the URL, it goes in a WWW-Authenticate: header. This is the authentication the

Re: best practice or keeping sessions alive for several days

2014-07-23 Thread Seung Chan Lim
I'm on phone gap / iOS. I can see how I can send in the WWW-Authenticate header, but what would I need to do do take advantage of the keychain? I guess I'm looking for a plugin for that? (i.e. https://github.com/shazron/KeychainPlugin ) How does the replicator _automatically_ to take advantage

Re: best practice or keeping sessions alive for several days

2014-07-23 Thread Jens Alfke
On Jul 23, 2014, at 10:35 AM, Seung Chan Lim djs...@gmail.com wrote: I'm on phone gap / iOS. Oh right, that makes things a bit different. So you're sending a POST to /_replicate. The simplest way is to insert the username (and optionally the password) into the remote db URL:

best practice or keeping sessions alive for several days

2014-07-22 Thread Seung Chan Lim
I want my users to be able to take advantage of offline use of the app. The only way to authenticate them is through the sync gateway, which requires that they're online. So I can have them authenticate once while they're online, then keep the session cookie cached and use it to replicate

Re: best practice or keeping sessions alive for several days

2014-07-22 Thread Jens Alfke
On Jul 22, 2014, at 1:47 PM, Seung Chan Lim djs...@gmail.com wrote: The question is, what's the best practice to doing this over a long duration of time? What if they're offline for days? They might need to re-authenticate, if you're using cookies and the delay is longer than the session