I'm building a dashboard for a client. It starts up in Chrome kiosk mode and begins displaying all activity for the day's transactions continously on a screen placed high on the wall. They asked for no user input since its going to be placed high on the wall for all the office to see.

It's an Angular UI that is served up from a Node.js server running Express.js. That same server serves up an ionic version when hit by a mobile browser. Neat stuff.

How can I authenticate the dashboard from the mobile site?

I'm thinking the answer is something like WhatsApp web: Have the kiosk mode generate a QR code containg identifying data (IP, and a random hash) to be read from the mobile app. The mobile app can then scan the QR, and fill in username and password to send to the server.

Tell the server: "I'm authenticating with these credentials, once you verify them, give access to this {{ip}} running this {{browser}} and sending this {{hash}}."

I could find anything on two screen authentification. Whats the "good-idea" scenario here?

  • Require TLS, then you'll probably want to use an application key since the interface will be inaccessible. Otherwise require someone to login frequently. Take a look at OWASP. – user2320464 Oct 12 '16 at 5:58
  • update: Apologies if I didn't describe the issue well. the crux of the matter was that the client didn't want their api and dashbaord being accesed from another location. At the same time, they needed to have the terminal running with out any input. the issue was solved with a client certificate that ensured that the machine in cuestion could pull up the data correctly. – LuisMa Suárez Gutiérrez Jan 18 '17 at 21:58

Sounds like you need to authenticate the device, rather than a user. Also sounds like you have complete control over what is installed on the kiosk.

I would approach this problem using client certificates. You would simply need to install a client cert on the kiosk (in the machine store, if it's Windows) and configure the web server to map the client certificate to a user identity. You should not have to write any code to do any of this.

  • it wasnt not really a kiosk in the sense that it was for the general public or for a mall . it was a dashbaord for the companie's control center where the call center agents could monitor all the operation. so it needed to be available as standalone display. we indeed fixed it with a client certificates, now every time they power up the l computer it authenticates and display all the data . – LuisMa Suárez Gutiérrez Jan 18 '17 at 21:50

I find it not clear from your description what needs to be authenticated: The user or the kiosk machine. Despite of that, I'd like to pick up your idea with the QR code but refine it a little bit: Instead of having the mobile device generate user id and password I would generate a 6 digit OTP. You probably need to define number ranges or some other mechanism so that the 6 digit number can be attributed to one specific user. Maybe you need 8 digits. But this way you easily address shoulder surfing which is a big problem for kiosk PCs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.