1

I'm creating an app that runs both on the web and on mobile (loads offline files through cordova inside a webview)

For my user's login forms in the web vesion, I use google captcha to protect automated logins, works well.

For logins on the app, I can't use captcha because the page is offline, so there is no way I can setup a google captcha domain. Now I can disable the check for recaptcha for this endpoint, but it will be pretty much opening up for bots again, since the user can just use the app id from the app and skip the check.

I have been thinking of a solution but couldn't find any that seemed simple to implement. Any ideas?

  • If they're logging in anyway, they must be online, right? Cordova is just a chrome-less web browser, can you not just hit the login page and use the captcha from inside Cordova? Some other options: in-app browser, or OAuth flow with your own site, so you leave the app and go to their system's browser to login. Lastly, you could just use Captcha on registration to ensure they're not a bot, and then Captcha on the login page if they fail to login an arbitrary number of times. Then if they're in the app, just force them to login from a browser if they're locked out. – nbering Apr 9 '18 at 0:51
  • The problem is that google requires captcha to run on a known domain that you have to setup on their website, cordova serves local files. – raphadko Apr 9 '18 at 0:58
  • Yes, but if I recall correctly, there's nothing in Cordova preventing you from loading a page from a remote URL. – nbering Apr 9 '18 at 1:00
  • That is true, very well noted. So I would log them in and then send the auth token back to store in cordova, do you see security threats on that? – raphadko Apr 9 '18 at 1:04
  • Just be careful where you store your auth token. Local storage should be ok. Obviously you won't be able to use an auth cookie since the login happens on a separate domain than your application code. In the end it all depends who you consider a threat. – nbering Apr 9 '18 at 1:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.