What is the reason for PrintWhere using an http connection to share SSO tokens? - c06241161

During the OAuth login process the remote system needs to send information to the client - in this case, the client is the mobile app or the PrinterOn PrintWhere application.

It does this by redirecting to the local loopback address.

By using http://127.0.0.1 the browser loads a 100% completely local on the device and safe page.

PrintWhere and the apps watch the browser and when it loads this redirect URL it can then pull the information it needs to continue authentication from the browser.

Because we are using 127.0.0.1 and not a host name, the DNS information cannot be tricked.

The key point is that the information is not going anywhere other than a local browser with that redirect URI, neither on the local network or the internet, and is therefore secure.

NOTE:

Applies to PrinterOn PrinterWhere 6.1.x and later.