Embedded Login Security Settings

How users log into an embedded app.

When using logins on an embedded app, there are two settings options available for how user logins are managed, Cookies and Tokens. Each option will give your users a different login experience:

 

• Cookies

  • Users logging into your embedded app will be redirected to a consent screen to log in.

  • White labeling, the option to conceal Knack’s name in the URL, is not available with this option.

• Tokens

  • Users logging into your embedded app will log in using the Knack login view.

  • White labeling is available with this option, so Knack.com will not appear in the URL.

  • This is less secure than using Cookies.

Embedded Login Options

There are two different types of login options, each with trade-offs to consider that will determine your user’s login experience.

Cookies

With the cookies login setting, the embedded app opens a new browser window to complete the authentication for the user logging in.

For this option, users logging into your embedded app will be redirected to a consent screen to log in. White labeling, the option to conceal Knack’s name in the URL, is not available with this option.

How does this option work?

When you log in to your Knack app, a text file with unique data called a cookie is stored within your browser. The data contained within that cookie is a unique identifier of you and your computer that tells the app what data to share specific to you. To put it another way, think of your browser as a pantry, where each website you visit has its own cookie jar. The cookie jar can have two classifications of cookies:

• First-Party Cookies are stored by the domain you’re visiting directly

• Third-Party Cookies are stored by domains other than the one you’re currently visiting

When you integrate your Knack app into your website, your website is considered the primary source, while the Knack app is considered a secondary source. In the past, it was common for secondary source cookies to be stored in your website's cookie jar. However, due to concerns about privacy and online tracking, web browsers now block this practice by default. This is done to enhance privacy and protect users' personal information while browsing the web.

In order to authenticate the user, a consent screen is now required to allow our cookie to live in your website’s cookie jar. The consent screen must show the browser’s address bar and the domain must be the authenticating domain (Knack.com) so it cannot be white-labeled. This is the same experience you may already be used to if you log in to other websites using a Google or Facebook account.

To use this option, select the Cookies option for the Embedded Login Security in the User Settings of your app.

Tokens

With the tokens login setting, the embedded app uses a normal Knack login form. For this option, users logging into your embedded app will not be redirected to a consent screen to log in and can log in directly through the embedded app.

 

How does this option work?

When you log in to a website, this option stores tokens in the browser. These tokens can then be used to authenticate the user logging into your app.

To use this option, select the Tokens option for the Embedded Login Security in the User Settings of your app.

Understanding Security Risks

We recommend only using this option if you have full control over every computer that could potentially access your app and can ensure they’re only using trusted browser extensions. For example, you could use the IP whitelisting option to ensure only users located at a specific IP address are accessing your app.

This option goes against security best practices because using tokens can be prone to Cross-Site Request Forgery (CSRF). This creates a potential vulnerability where a third party could gain unauthorized access to the token value and log in as the user. For instance, a malicious script could run on your webpage, search through your browser's storage, duplicate the token value, and pretend to be the user by using the duplicated token value.