Phone-Gap Claims Authentication against SharePoint in Office365 fails, probably because of HTTPOnly flag in cookie

Question

I am coding an application using Phone Gap to connect to a Sharepoint in Office365.

I need to use the REST services in Sharepoint Office 365 to add items to a list, but before that I need to authenticat

This is the javascript code I use to authenticate:

    $.ajax({
        'url': 'https://login.microsoftonline.com/extSTS.srf',
        dataType: 'text',
        type:'POST',
        'data': '<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"><s:Header><a:Action s:mustUnderstand="1">http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue</a:Action><a:MessageID>urn:uuid:40c1407d-b2a4-4e05-8248-8a92b71102b6</a:MessageID><a:ReplyTo><a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address></a:ReplyTo><a:To s:mustUnderstand="1">https://login.microsoftonline.com/extSTS.srf</a:To><o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"><u:Timestamp u:Id="_0"><u:Created>2012-07-26T16:13:00.622Z</u:Created><u:Expires>2012-07-26T16:18:00.622Z</u:Expires></u:Timestamp><o:UsernameToken u:Id="uuid-69882db9-2d6b-45d3-b016-c2156cb6c01d-1"><o:Username>admin@somethingonline.onmicrosoft.com</o:Username><o:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">******</o:Password></o:UsernameToken></o:Security></s:Header><s:Body><t:RequestSecurityToken xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust"><wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"><a:EndpointReference><a:Address>https://somethingonline.sharepoint.com/_forms/default.aspx?wa=wsignin1.0</a:Address></a:EndpointReference></wsp:AppliesTo><t:KeyType>http://schemas.xmlsoap.org/ws/2005/05/identity/NoProofKey</t:KeyType><t:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</t:RequestType><t:TokenType>urn:oasis:names:tc:SAML:1.0:assertion</t:TokenType></t:RequestSecurityToken></s:Body></s:Envelope>',
        headers: {
            Accept : "application/soap+xml; charset=utf-8"
        },
        success: function(result, textStatus, jqXHR) {
            console.log('done in login ');
            console.log('result '+result);
            var xmlDoc = $.parseXML( result );
            console.log("xmlDoc:"+xmlDoc);
            var xml = $( xmlDoc )
            console.log("xml:"+xml);
            var binToken= xml.find( "wsse\\:BinarySecurityToken" ).text();
            console.log("Binary Token:"+binToken);

            //  alert(  localStorage.getItem('BinaryToken') );
            wsignin(binToken);
        },
        error:function (jqXHR, textStatus, errorThrown){
            console.log(errorThrown+'error login:' + jqXHR.responseText);
        },
        complete:function(jqXHR, textStatus) {
            console.log('login completed ' + textStatus);
        }
    });

Which basically sends an <s:Envelope> requesting authentication.

This sends an XML with a <wsse:BinarySecurityToken> which we then use to actually authenticate:

function wsignin(token){
    // alert(  token );
    console.log('start wsignin' );
    console.log('wsignin token:'+token );
    $.ajax({
        'url': 'https://somethingonline.sharepoint.com/_forms/default.aspx?wa=wsignin1.0',
        dataType: 'text',
        type:'POST',
        'data':token,
        headers: {
            Accept : "application/x-www-form-urlencoded"
        },
        success: function(result, textStatus, jqXHR) {
            console.log('done wsignin ' + result);
            // alert( result  );
        },
        error:function (jqXHR, textStatus, errorThrown){
            console.log('error wsignin:' + jqXHR.responseText);
        },
        complete:function(jqXHR, textStatus) {
            console.log('complete wsignin ' + textStatus);

        }
    });
    console.log('end wsignin' );
}

All this works perfectly with Explorer 9 (using jQuery.support.cors = true;) but, the exact same code, with Phone Gap, instead of returning in the result the html of the main page inside https://somethingonline.sharepoint.com/ it returns the Office365 login page.

What can I do? What am I doing wrong? Is there some other way to authenticate?

Update: Reading on MSDN found this:

SharePoint Online Authentication Cookies

An important aspect of this process, and the one that makes it difficult but not impossible to use remote authentication for SharePoint Online in client-side applications, is that the FedAuth cookies are written with an HTTPOnly flag. This flag is designed to prevent cross-site scripting (XSS) attacks. In a cross-site scripting attack, a malicious user injects script onto a page that transmits or uses cookies that are available on the current page for some nefarious purpose. The HTTPOnly flag on the cookie prevents Internet Explorer from allowing access to the cookie from client-side script. The Microsoft .NET Framework observes the HTTPOnly flag also, making it impossible to directly retrieve the cookie from the .NET Framework object model.

Maybe this means... that integration with Sharepoint Online in Office365 ¿is plain impossible?

Answer 1

Very interesting topic.

The integration with Office 365 and SharePoint Online is possible. See the detailed instructions and examples for .NET, .NET again, node.js, python.

I have tested it in javascript, in node.js and it works. There all you need to do is to install sharepoint node package. The logic is the same as in .NET or python or Java, the same as you do in your code:

1. Send a SAML code to STS (Security Token Service) with username, password and endpoint.
2. Send the token you've got to the login page. Capture the cookies rtFA and FedAuth
3. Append these two cookies as request headers in every request to the sharepoint online site.

I tried your solution (which I modified a little bit). Requesting the token works and the wsignin works perfectly.

The only thing that doesn't work are the rtFA and FedAuth cookies. I can't get them in a XMLHttpRequest in the PhoneGap WebView (which is a kind of a mobile browser). So these cookies aren't sent automatically, and you can't get them in a webview with javascript. You have to create some additional server layer to handle authentication and data retrieving.

UPDATE: The only "Set-Cookie" I get in the XMLHttpResponse from wssignin page is MSPOK:

set-cookie: MSPOK=$uuid-3367547c-f7aa-4054-aa34-fdf0de2ae83d$uuid-445d329f-6466-42f4-b1c7-5f417fa528af$uuid-2a4bba00-1e7b-494d-af4d-19fb7c2646ff$uuid-1bfdab84-eacb-4908-88df-d7e7e927749e;domain=login.microsoftonline.com;path=/;version=1

Answer 2

I don't know if you resolved your problem yet, but I would try to set the UserAgent header inside your requests to a valid browser User Agent, for example:

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)

It should help.