Mobile Authentication

[TekExplorer]

Hi, I'm the dev for Featherdactyl, a mobile app for pterodactyl and pelican

Currently, I can make logins work by creating a webview, letting the user login, then injecting JS to create an API key

However, I cannot then let the user access additional features available on their panel directly, as a saved session would eventually expire.

There are several options available:

• Log in using an api key by posting to a login endpoint, no auth required
  • Not sure how secure this is, but since an api key can be used to do most things on your account anyway, maybe its fine?
  • Might require a special permission...
• Switch to (or support) JWT auth, such that a mobile app can use it directly, and it could be injected into a webview to continue functioning
• Something with security keys maybe?
  • Like, register a security key when the user first logs in, and use that security key to authenticate the webview as desired? I assume you can inject JS to do these things.
  • This is similar to the first option, but probably more secure.
  • It does mean i would have both an api key and a security key, and could result in desync and something akin to a tiny memory "leak" if one is deleted but the other isnt.
• Something something oauth2 dynamic client registration?
  • Would require Pelican to be an oauth2 provider itself.
  • Not sure if that would even fix the problem, though it would make signing in in the first place easier.

I am open to options.

[NerdsCorp]

You could make a plugin to support JTW auth, but I don't see any reason for you to not use the client API, but that being said I have almost no experience with android and iOS development besides PWAs.

[TekExplorer]

The isssue is that I would like to include a button that opens the actual panel in a webview for features that dont exist in the app, such as plugins.

Currently, i'd have to open the webview, and hope the session cookie hasnt expired yet. Then, if they log in as a different user, what state do we even end up in?

A plugin would necessitate that everyone use it, which goes against the core of my app, which is that it should work on every panel out of the box.

[NerdsCorp]

Many apps handle this by prompting users to re-authenticate when transitioning into a web view, which helps re-establish the session for any changes that fall outside the app's native functionality. A great example of this approach is how most Google products handle it on iOS.

I can absolutely appreciate how a solution like this might be beneficial for your specific use case, and I want to acknowledge that perspective. That said, I think the implementation may have a more limited impact for users who don't interact through your app directly. With that in mind, I believe the most universally beneficial path forward would be to focus on adding the necessary API endpoints — that way, the functionality becomes accessible to a much broader audience in a flexible and scalable way.

But ultimately I'm not apart of the core pelican team, I'd like to hear their input for sure!