Native Mobile App Secure Bridge to Hosted Content - .htaccess

I would greatly appreciate some help with the following problem.
I am attempting to build an app with HTML/CSS/JQM that I plan to wrap with PhoneGap to package as a native app for deployment on Android & iOS Platforms.
The app will be basically a form for users to input information which upon submit will be posted to an email using PHP on our web server. It is of the utmost importance that the information is encrypted between the user device and our web server.
I have planned to do this by having a single terms & conditions page packaged with the native app, with the 'accept' button loading the 'form' page on the web server.
I would like to make it impossible to access the hosted 'form' page via a web browser (i.e. the only way to access the page is via the native app).
What I would like to do is to have the native app automatically log in to the web server, so that the user does not have to go through a registration process.
I have considered using Wordpress, Drupal or Joomla as a solution but as there will only ever be a single html page, jquery, jqm and php form submission scripts on the server - this seems overcomplicated.
It is very important that the hosted files are unable to be hacked as the user information being submitted is of a sensitive nature (e.g. financial information). Also the connection between the native app and the host server must be SSL.
Would a .htaccess / .htpasswd restriction be the best way to go about this?
Any advice would be greatly appreciated, thanks.

Related

I want to build a web project that consist both mobile and web ui versions

I have noticed in many websites they have both web and mobile version separatly with the same domain name but with different subdomains. For example, web.websitename.com and mobile.websitename.com. I am aware of using media queries in css for showing different ui with the help of css, but how its made on the url. How does the browser finds what type of device it is, like mobile or desktop. If anyone knows please help me.

How to build web application that run in WeChat in app browsers?

I am trying to build a simple web application, which capture users photo and sent it my custom server there by connected to some other business use-case. My web page uses HTML's file input control to launch native camera or gallery pick up option.
var input = document.createElement('input');
input.setAttribute('accept', 'image/*');
input.setAttribute('capture', 'camera');
input.setAttribute('type', 'file');
input.click();
This web app, I placed in local webserver with a name "PhotoLocker" and testing with url like
https://localhost(ipaddress to access via mobile browser)/PhotoLocker/index.html
This link is working fine both on desktop and mobile chrome browsers and am able to debug any issues. Where as same link, I try to access from WeChat browser (just opening above link from chat window), it is not at all opening my application in WeChat in app browser.
After googling, I found that https URL scheme is not supported by WeChat. is it True? When I paste the same app url as weixin://ipaddress/PhotoLocker/index.html, I am able to see my web app home page but it is not working as expected.
My Question is - how to debug my webpage opened in WeChat browser? Do I need a official WeChat Dev account even to develop and test sample apps?
Additional Info :
I am able to debug webpage from WeChat web devloper tool as mentioned in below link. But, unable to debug mobile wechat page in this tool. It is always opening chrome dev tools.
https://mp.weixin.qq.com/wiki?action=doc&id=mp1455784140&t=0.06697335132505233#1
I am a frontend developer in China, Chinese. Forgive my English for any mistake, misunderstanding I could make. Some links (dev docs mostly) below contain sites complete in Chinese, because I can not find corresponding English ones for now.
how to debug my webpage opened in WeChat browser?
Tencent provide an IDE for developing regular web interface and WeChat-mini-program, with which developer can directly interact with:
JSSDK (basically a special weixin
Object lives only in in-WeChat-browser);
API provided in WeChat-mini-program.
If you download that IDE:
First it will ask you is to use you WeChat to scan the QRCode, then confirm login with your WeChat account;
Next it will show up two square button (image below), left one is for WeChat-mini-program, the right one is for you to testing regular web page.
Click the right blue one, then you can find your way out, it's just something built top on project Blink.
As you can see the part of debugging regular webpage in WeChat IDE is no more than a simulator (in the WeChat-mini-program part, developer can write code directly in it), and in my experience it does have bugs, you will still need to test code in real machine.
For that Tencent provide another tool called vConsole, tutorials here, with it you can do following things directly in in-WeChat-browsers:
View console logs;
View network requests;
View document elements;
View Cookies and localStorages;
Execute JS command manually
and so on
Do I need a official WeChat Dev account even to develop and test sample apps?
Depends.
You may know the Official Account inside WeChat, with webpages directly opened in any context inside in-WeChat-browser, it will have the ability to interact the weixin Object, or have some API like login with WeChat, pay with WeChat Pay:
API like close current in-WeChat-browser, hide-share-button will not required anything special, you don't need to register any Official Account;
But if you want yo do the Pay, Login thing, you need an Official Account and pay for the ability every year (not sure about this outside China).
The localhost problem you faced
I don't have my working machine with me now so I can not test. Regularly I can proxy localhost with Charles then debugging in WeChat, but never do the https, I will try it later.
All the information got regarding how to debug webpage opened in wechat browser redirects to how to see log or ajax/netwrok calls analysis.
Even with WeChat web devloper tool as mentioned in below link, I am unable to debug mobile wechat page in this tool. It is always opening chrome dev tools.
https://mp.weixin.qq.com/wiki?action=doc&id=mp1455784140&t=0.06697335132505233#1.
Hence further analyzed remote mobile webpage debugging and found that there is no way to put break points, watch, expressions and all just like in chrome dev tools is not possible.
As a work around - you are able to debug code, when you simulate page in dev tools but no way to debug webpage in mobile device.
Same webpage when tried to do remote debugging as per WeChat web devloper tool documentation. here we can only see console logs and network calls.

Create link to open app from mail without making changes in app

I have an app which is already published in app store, I need to send mail to users with link clicking on which it should open the app if its installed or should go to app store. I'm aware of the URL schemes and universal links and that would require modification in my app. I was wondering if there is any other way that this could be achieved where I could create a link maybe using itms-app or some other method where I don't need to make any changes in the app. Any help is appreciated
Unfortunately, not. For a phone to open your application, it needs a way to recognize your application.
URI Schemes
The URI scheme information is configured in the .plist file and is local to the application and therefore cannot be changed without an update. Although you probably don't want to use URI schemes anyways since they will present the user an error if they don't have the app instead of taking them to the app store.
Universal Links
This is the new way Apple performs deep linking and the only other way a link could open up the app. These require a locally stored entitlements file along with an .apple-app-site-association that is hosted on your own website domain and cached when the app is downloaded or updated. These also do not take users to the app store, they take users to the domain in which the AASA file is hosted.
Best Solution
Use Branch's iOS SDK to handle all of the AASA file hosting and App Store redirection. This would still require you to push out a new update, but that is the only possible way to accomplish this.

Hosting ASP.net website through coding in C#

We already have some .aspx pages that comprise a website. We can browse these pages in the browser once we host that website in IIS. But now our requirement is to host these pages in the standalone C# application. Is there any way to do this?
You can create custom browser in your C# application using below links
You can try this.
Link for create browser
another link for create browser

Chrome extension security

I am developing a GWT based client server web application.
The application installs a web site on the IIS.
When clients first browse to the web site, they need to run a local installation, which installs a local process and a NPAPI plugin on the client computer.
The client runs in browsers such as IE, Chrome and Firefox,
and uses the NPAPI plugin to send messages to the local process.
The local process is used for accessing the file system, registry, etc.
In order to prevent other web sites from using the NPAPI plugin,
When a user first login, the server sends him a hash of a string which contains the URL of the site + some other data.
The NPAPI plugin has access to the current URL of the browser, and also creates the same hash and compares the two.
Due to Chrome upcoming end of support of NPAPI plugins, I am trying to replace the plugin with a Chrome extension, and a native messaging host.
The extension can't be limited to a certain domain because it can be used from many domains.
I am trying to figure out a way to prevent other web sites from using the extension to send messages to the native host but can't find a way to do it.
Does anyone have an idea how I can accomplish that?
Any advice would be greatly appreciated, thanks.
Have you considered having the extension be limited to a specific domain, and then having the other domains iframe that domain and communicate via postMessage? You could have a whitelist of domains in the JS of the iframe, and validate the message origin against that list.

Resources