Best way to make one browser session mimic the other in javascript?

Using Django Forms & APIs
1

Some background: a MS office addin is embedded into either a client app like MS Word on the desktop or in a browser instance using office (dot) com.

Authentication is a bit tricky since it requires the use of a non-modal dialog that is a separate browser instance. Specifically in office for web, the taskpane is an iframe and the dialog is a
separate browser instance.

Assuming I’ve been able to authenticate the user in session A: the dialog browsing context, how do I authenticate the user in the session B, the taskpane context?

Screenshot 2023-09-16 at 11.12.46 AM
Screenshot 2023-09-16 at 11.12.46 AM970×1054 28.1 KB

Is it possible to use the authenticated session object from the dialog as the modified session for the taskpane?

2

Should be fine if you use the same browser. The Django session cookie is I believe shared between tabs.

3

Hi @dennisvd, unfortunately it doesn’t share the same context. I should have included the dialog box’s characteristics in the question. Being a separate browser instance from the task pane, the dialog:

  1. Has its own runtime environment and window object and global variables.
  2. There is no shared execution environment with the task pane.
  3. It does not share the same session storage (the Window.sessionStorage property) as the task pane.

I’m able however to send information back to the taskpane using a specific JS method from the officejs library. I’ve tried sending a authentication token to the taskpane “parent” but still unable to duplicate the session in the taskpane to make it mimic the authentication session from the dialog.

4

For a persistent authentication you have some other options like:

  • Use a Single Sign-On provider’s SDK on the client to get auth tokens.
  • Use Token Authentication - When a user logs in, generate a token that is returned to the client device. The client stores this token and sends it in the Authorization header on subsequent requests. The token can expire after a set time period.
    Check out:
    Django REST framework tokenauthentication
    or
    Django OAuth package.
    There a probably some other packages that have similar support for a persistent authentication.
5

Thanks for the suggestions.

I didn’t want to use the REST api indefinitely. I just want to replicate the session and proceed to the regular Django template / session authentication based on the request object. I managed to get it working via the following route:

  1. Use drf to generate auth token per user
  2. If user successfully authenticates in the dialog, pass token to taskpane
  3. Use token in taskpane via javascript fetch, to reach a special view which determines if token exists and matches a user, then executes django.contrib.auth.login()
  4. The response, if it’s a valid user, adds the following response headers to the taskpane client: Set-Cookie (csrf), Set-Cookie (sessionid)
  5. The response headers however will only be added if the following settings are adopted:
    CSRF_COOKIE_SAMESITE = "None"
CSRF_COOKIE_SECURE = True

SESSION_COOKIE_SAMESITE = "None"
SESSION_COOKIE_SECURE = True
  6. Insofar as the taskpane is concerned, the session is replicated.
6

I see you are using the Django REST framework, yes it might be a bit overkill if don’t have any APIs :sweat_smile:.

Instead you might be able to use the other package that I suggested.

1 Like