Stay logged in on trusted machine

[yngwi]

I'm trying to find a way to let my users stay connected during browser restarts similar to a way they can stay logged into a webservice. Currently, a user has to enter their id/password each time they visit the website with my chat, even if they are on a trusted machine. Is there a way to achieve this?

Kind regards,
Daniel

---

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

[jcbrand]

Related to #1119

I can think of roughly two ways to do this.

1. Store the XMPP password in the browser. Either plaintext (not really secure) or when SCRAM is used as a hash.

2. Use cookies with a modified mod_auth_http_cookie that doesn't check the cookie against an external service.

Neither solution has an implementation in Converse currently. Any help with this would be appreciated.

[yngwi]

Thank you for the information.

[alexmat]

An example of the first approach mentioned by @jcbrand without encryption can be found here: https://github.com/alexmat/converse-autologin-example

[alexmat]

Looks like this might be a good library for implementing SCRAM using js: https://github.com/linuxwolf/sazzle

[jcbrand]

@alexmat: Strophe.js (which Converse uses) already does SCRAM-SHA1 login.

https://github.com/strophe/strophejs/blob/master/src/core.js#L3344

[stevenroose]

I think just storing the password and having the checkbox explicitly say "Store password in browser to automatically login in the future" would be enough due diligence.

[laszlovl]

Thanks for the inspiration @alexmat. I created a new "autologin" plugin that re-uses Converse's existing login form: https://gist.github.com/laszlovl/1df9ccfbd78bc07d19760ccdcd2ddef0

[yngwi]

The plugin works very well for me. Thank you

[stevenroose]

Could you please reopen, I'd like to have this as a built-in feature without the need for a plugin.

[sonicnkt]

Hi i tried @laszlovl posted Plugin but this isnt working for me with 7.0.6
Im using firefox 89 and after i close the browser and reopen it with the converse.js tab restored it still defaults to the login page.

I have whitelisted the plugin and also auto_login = true in my index.html, the password is stored in the browser which also autofills the login login fields.

Im only getting the following error:

Uncaught (in promise) Error: autoLogin: If you use auto_login and authentication='login' then you also need to provide a password.

[jcbrand]

This has been fixed in 10.1.0 via the reuse_scram_keys option.
https://conversejs.org/docs/html/configuration.html#reuse-scram-keys