Require user to go through login screen before giving access to iPhone app?

Question

On iPhone, how do I show a login screen to get username and password before giving access to iPhone app? Also, does the iPhone store a cookie to the secure website like a web browser?

I was thinking of giving users to my website a long API key to store in the settings of their iPhone instead of asking them to login with a username/password (seems to be the Slicehost iPhone app approach.) Which is the best way to get a user to login securely? I have full control over the design of the iPhone app and website so have a lot of flexibility.

Answer 1

I'd recommend looking at a technology such as OAuth (http://oauth.net/). This enables the user to authorize access to their account to an application without having to actually enter their username and password into it. Also means you dont have to worry about secure storage of the users credentials, and if their passwords change etc it doesn't matter.

It's used by facebook / twitter and a lot of other big name companies so its not going away (Its actually in the process of getting approved as an offical standard).

Answer 2

You can't restrict access to the app itself but it is trivial to present an initial view that ask for the username and password. If the user does not present the correct information then the app will not allow them to progress to the next view which actually loads the web site.

Likewise, it would be trivial to store a key in the app's sandboxed folders such that neither the user nor anyone else could access it save through the app.

Answer 3

I have this need in a couple of apps, and I use the following pattern:

In the controller for the first view that gets presented to the user, I have the following test, where UserPrefsManager is a singleton that knows the user credentials. This call causes a modal view to appear (FirstTimeWelcomeViewController) which tells the person that they need to register.

- (void)viewDidAppear:(BOOL)animated {
    [super viewDidAppear:animated];
    UserPrefsManager * prefs = [UserPrefsManager sharedInstance];
    if (![prefs isLoggedIn])
    {
        FirstTimeWelcomeViewController * vc = [[[FirstTimeWelcomeViewController alloc] initWithNibName:@"FirstTimeWelcomeViewController" bundle:nil] autorelease];
        [self presentModalViewController:vc animated: false];
    }
    else 
    {
        if (![[RWXLocationSingleton sharedInstance] hasLocation]) {
            [[RWXLocationSingleton  sharedInstance] findLocationWithAccuracy:kCLLocationAccuracyThreeKilometers withObject:self andSelector:@selector(updateLocationsView)];
        }
        [[self tableView ]reloadData];
    }
}

FirstTimeWelcomeViewController is basically a screen with buttons that greets people and takes them to the various ways to log in:

-(IBAction) createAccount
{       
    UIViewController * parent = [self parentViewController];
    CreateAccountViewController * vc = [[[CreateAccountViewController alloc] initWithNibName:@"CreateAccountViewController" bundle:nil] autorelease];
    [self dismissModalViewControllerAnimated:false];
    [parent presentModalViewController:vc animated: false];
}

imagine that these also exist for forgotPassword, and loginACcount... same pattern. This causes the current view to be replaced by a view handling the specific case that they've pressed the button for.

taking the 'loginAccount' method, you've opened the LoginAccountViewController, and it has a method called loginButton, which works something like this...

-(IBAction) loginButton
{
    NSString * u = [self.username text];
    NSString * p = [self.password text];

        //
        // app specific logic that tests various inputs and creates a user object.
        //
        // goes here...
        //

        if([user checkValid])
    {
       UserPrefsManager * prefs = [UserPrefsManager sharedInstance];
       [prefs setPassword:p];
       [prefs setUsername:u];
       [self dismissModalViewControllerAnimated:FALSE];
    }
        //
        // more app specific stuff
        //
}

And that's pretty much that. You have to use one of the standard ways for putting stuff in the keychain or user defaults to save your information. check that the one you pick lasts between restores if it is something that is annoying for the user to recreate. The first part is the most useful bit, thought the rest might be useful for context.