Skip to content

Commit

Permalink
Merge branch 'master' into vincent-dfinity-patch-1
Browse files Browse the repository at this point in the history
  • Loading branch information
jessiemongeon1 authored Jan 2, 2025
2 parents b344a12 + 88eba87 commit 1a1c949
Show file tree
Hide file tree
Showing 42 changed files with 33 additions and 169 deletions.
2 changes: 2 additions & 0 deletions docs/developer-docs/security/security-best-practices/iam.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,8 @@ Never use `agent.fetchRootKey()` in production builds, only in test builds. Not

## Integrating Internet Identity on mobile devices

A [short presentation](https://www.youtube.com/watch?v=iRmpCkzC6iI&t=1863s) can be found as part of the November 2024 global R&D.

### Security concern

Internet Identity has a standardized way for web applications to request authentication of a user. This [client authentication protocol](/docs/current/references/ic-interface-spec#client-authentication-protocol) allows a client dapp frontend to obtain a delegation signed by the Internet Identity for a locally generated session key pair. Using this delegation in combination with the session key allows the dapp frontend to make authenticated calls towards the backend canister. Such calls need to be digitally signed by the session private key. The IC will verify the signature and verify if there is a delegation (or chain of delegations) from II key to the session public key.
Expand Down
Loading

0 comments on commit 1a1c949

Please sign in to comment.