Is it possible to use some sort of stateless authentication to control access to the site front end?

For example oAuth or openID (is this stateless)?

The use case is we are trying to work out a way to authenticate users of an iOS/Android app that will interface with an existing EE site.

EDIT: I think my original question may have been badly phrased. What we were looking for was a means to use HTTP authentication so an iPhone app could interface with the EE front end. Apparently if we used the regular EE authentication this might cause issues getting the app approved by Apple. They prefer "native" over "web"


I feel the need to clarify the reason behind this authentication requirement.

Its more about REST best-practices than getting the app Approved.

REST is by nature stateless (see here: en.wikipedia.org/wiki/Representational_state_transfer), however EE uses Session-based authentication. Turning on Basic HTTP Auth allows us to authenticate statelessly with the API rather than play around with a session cookie on the client side. Also worth noting that the libraries being used on the clients-side have nice support for Basic HTTP Auth, ie: http://cocoadocs.org/docsets/AFNetworking/1.3.1/Classes/AFHTTPClient.html#//api/name/setAuthorizationHeaderWithUsername:password:

In terms of Approval, wrapping a web view in a thin native shell might get the app rejected so consuming the data via REST and caching/displaying it natively is the best option.

  • I think we've solved this problem using EE's built in HTTP authentication within template preferences.
    – foamcow
    Nov 15 '13 at 10:29
  • Could you please share some more info how did you solve. I 'm curious to know it. Nov 15 '13 at 11:37
  • I will when I'm sure it's working :)
    – foamcow
    Nov 15 '13 at 12:16
  • 2
    I had no problem using EE's native authentication (albeit via Zoo Visitor's ajax login). App got approved last week. And I use PhoneGap so the whole thing is in a webview so to speak.
    – notacouch
    Nov 17 '13 at 17:56
  • @notacouch, what's your app called (if you don't mind me asking) ?
    – sf13579
    Nov 19 '13 at 20:01

For the benefit of others it appears we have solved our problem by setting HTTP authentication on the templates we are using.

Do this via Design->Template preferences, select the template and set HTTP authentication to 'yes' (the option at the bottom of the form).

This uses HTTP authentication against the EE member credentials stored in the database and allows our phone app to use HTTP authentication rather than EE's sessions which apparently can make it easier to get app approval from Apple.

What this means for us is that we can basically create a template group which acts as a kind of API and let's us return data to the phone app as needed.

This appears to work OK for our needs but it's early days and we were just experimenting so your results/requirements may differ and we may run into issues further along the line.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.