3

I'm trying to develop a native OS X app that uses the Nest API. Unfortunately, their client registration only accepts "https://" URIs for the redirect-URL. Since there's no server involved in this (other than Nest's server), I need to redirect to my app. To do that, I need to be able to redirect to an arbitrary URI.

I tried to send this feedback to Nest directly, but they don't seem to have a support contact or bug reporting available.

Am I missing some other authentication approach for this type of use? It's a similar problem on iOS.

Thanks!

Rick
  • 3,298
  • 3
  • 29
  • 47

1 Answers1

4

Nest can only assure in the normal browser world that HTTPS is secure. Yes, there are other application protocols that are secure, but the standards are not well defined. As such the return URIs are limited to HTTPS and HTTP://localhost (It is assumed that is someone has control of your machine, they can also intercept HTTPS calls)

Mac OS and iOS have a relatively simple workaround for this that is demonstrated in Nest's iOS NestDK sample code. The key parts are:

  • In line 30 of constants.m you will see that RedirectURL is defined (when running this sample code, you might want to change this to your preferred URL, likely something your company already controls for further security)

  • And in line 126 of NestWebViewAuthController.m where the app is checking if the WebView is trying to load our dummy redirect URI. If so, it captures the parameters and tries to get a token that can be used with the Nest API.

David W. Keith
  • 2,246
  • 17
  • 20
  • 1
    I see, thank you. What a hack. I'm not convinced the redirect URI needs to be secure, but whatever, that seems like it will work. – Rick Aug 08 '14 at 05:24
  • Per OAuth2 spec all communication has to use secure transport layer (thus the necessity for https). On the other hand per Oauth2 spec you should have different flow for applications (Desktop,Mobile, Javascript etc) in which you don't use client secret because you cannot secure it in a distributed app, but it seems they don't respect this for some reason. – Igor Čordaš Nov 19 '15 at 15:38