I need to associate a desktop application with a particular user’s account on a web site. Till now, the workflow was as follows:
Current process
- Desktop application asks for user’s email, password and some extra info (computer’s name).
- It calls into a web site using REST with user’s credentials, gets a newly created token and stores it. That token is used for authenticating the desktop application.
New process
Now, I want to allow users to sign up and log in into our web site using Facebook and possibly other third-party web sites. Obviously, Facebook log-in process cannot happen inside my desktop application, so I’m looking for a way to have all the association process in the browser, and transfer the generated token from the browser into the desktop application as the last step.
I prefer to use user’s default browser, and not WebBrowser control, since WebBrowser control uses IE, and if it is not the user’s default browser, all cookies (and Facebook login, etc.) will be missing.
Problem
What is the best way to automatically pass the 24-character alphanumeric token from a page open in a web browser to a desktop application. Manual cut&paste will not do… If there is any other way to sanely achieve what I’m trying to do, I’d love to hear about it too.
Platform
Desktop platform is Windows (currently), but we’re looking into creating client for MacOSX too. Web platform is Ruby on Rails 3.2 + jQuery.
For obvious security reasons, browsers don’t have this kind of functionality.
Since browsers cannot directly save files to a user’s disk, your web app would have to generate a file with whatever OAuth token (Facebook, Twitter, whatever) and data you want into a file with a known file extension like “12345.haimg” and have your desktop app associate that file type within the OS so when the user opens the file, it passes that data to the desktop app. But while the web app can trigger an auto-download, the user will need to manually open the file themselves to ‘register’ to your desktop app, and since you can only associate one file extension with one application, you would need to set up multiple file extensions and file associations. Sounds more trouble than its worth.
You could always just expose a hash token of some sort to the user in the web app which you could decode within your desktop app. The user would still need to manually cut and paste, but if it’s a one-time occurrence it shouldn’t have much impact, and will seem more secure to them than downloading lots of files, etc.. There will be a lot less overhead on your IT staff who wouldn’t have to set up all the file associations mentioned above.