https://descope.com logo
Join Slack
Powered by
How can a project be configured to support an appl...
# ask-a-descoper
b
How can a project be configured to support an application that has web and mobile clients with the following requirements: 1) Tokens should be available to the mobile applications through the Descope SDK, 2) web tokens should the managed through 
httpOnly
cookies as is best practice and necessary to prevent XSS attacks?
I think I'm missing something in the documentation. Inkeep reported that this is impossible and that I need to have one project per platform (mobile and web). But since user's are associated with projects this adds an unnecessary level of complexity to keep the user collections in-sync between projects (not to mention doubling the cost as it doubles the number of MAUs).
Having a single application with multiple front-end clients is a very common use case, so I have to imagine that this is possible.
p
@Atharva Joshi @Rahul Rijhwani
a
let me check this
@Benjamin Cassidy i have passed this on internally. We'll get back to you with an update ASAP CC:@Asaf Shen
d
@Atharva Joshi @Benjamin Cassidy Hope you guys are doing great. I just wanted to check with you on whether you have got through this or not? If yes, would love to understand what have we done to make it work. Asking as we are also having the same requirement and will be working on it in a few days time. Your experience on this may help us solve this proactively.
a
reg the web app - we do support 
httpOnly
cookies, setting this can be done only in descope configuration (session management -> refresh/session token settings) https://docs.descope.com/security-best-practices/session-token-storage. this does not require any special configuration in the SDK
reg the mobile app but our mobile sdks do support exchanging access keys for a token
b
I think there is a disconnect here. I am attempting to use one project in Descope for an application that has both web and mobile clients. I want to configure the project to use 
httpOnly
tokens because that is best practice for web security. But when I enable this on the project, the mobile SDKs return an error because after completing the sign in flow it cannot get a token because tokens are managed in cookies. In order to support the mobile apps, I need to turn off 
httpOnly
tokens. You said the mobile SDKs support exchanging the access keys for a token. This means that we cannot use flows in the mobile apps then, correct? This is unfortunate because that is one of the value propositions of descope and helps enforce consistency across platforms. cc: @Atharva Joshi @Debashish Bharali
Open in Slack
PreviousNext
Powered by