Dear Developers,
We have found this security gap and would like to know if there is anyway it can be addressed.
All we want is authenticate wix member on each data query/submission on ios app.
Our members are wix registered members who once buy a plan will login to IOS app to respective plan interface and submit related data.
Attaching business flow which we designed for one of our esteem client
Authentication and data submission api used for first time login in ios app>
http-functions.js
import wixData from ‘wix-data’;
import wixUsers from ‘wix-users-backend’;
import { created, badRequest, forbidden, get, notFound, ok, response, use, serverError } from ‘wix-http-functions’;
//URL
//https://lioonnize.wixsite.com/cfa-jun/_functions-dev/apiForTokenForLogIn?userName=*****@gmail.com&password=*****
export function get_apiForTokenForLogIn(request) {
let userName = String(request.query.userName);
let usersPassword = String(request.query.password);
return wixUsers.login(userName, usersPassword)
.then((sessionToken) => {
let successReturnValueObject = {
headers: {
“Content-Type”: “application/json”
},
body: {
“sessionToken”: sessionToken,
// this is an estimated amount could be 120 secs
“expiry”: “90.0”,
}
};
return ok(successReturnValueObject);
})
.catch((error) => {
let errorMessage = “could not access session token for user, since failed authentication.”;
console.log(errorMessage);
let failedReturnValueObject = {
headers: {
“Content-Type”: “application/json”
},
body: {
“errorMessage”: errorMessage,
“error”: String(error),
“userName”: userName
}
};
return badRequest(failedReturnValueObject);
});
} // End of ‘get_apiForTokenForLogIn’ Function
//https://lioonnize.wixsite.com/cfa-jun/_functions-dev/clientdatainsert
export function post_clientdatainsert(request) {
let options = {
“headers”: {
“Content-Type”: “application/json”
}
};
// get the request body
return request.body.text()
.then( (body) => {
// insert the item in a collection
return wixData.insert(“WaveClientData”, JSON.parse(body));
} )
.then( (results) => {
options.body = {
“inserted”: results
};
return created(options);
} )
// something went wrong
.catch( (error) => {
options.body = {
“error”: error
};
return serverError(options);
} );
}