javascript - How to store credentials in an Outlook Add-in - Stack Overflow

admin管理员组

文章数量:1389978

I'm looking for the correct, secure way to store credentials for a third party API in an Outlook add-in. This overview of the different storage options only says not to store credentials in Settings, but not where to put them, so I assumed the RoamingSettings would be okay. Then I ran into this page with information about RoamingSettings, where it says that is not the right location either.

The question then bees: What is the right place? Should I build my own storage solution and store/encrypt the credentials in a file or cookie? That does not feel very secure either, since we are talking about what is basically a web app running in an Iframe.

I'm looking for the correct, secure way to store credentials for a third party API in an Outlook add-in. This overview of the different storage options only says not to store credentials in Settings, but not where to put them, so I assumed the RoamingSettings would be okay. Then I ran into this page with information about RoamingSettings, where it says that is not the right location either.

The question then bees: What is the right place? Should I build my own storage solution and store/encrypt the credentials in a file or cookie? That does not feel very secure either, since we are talking about what is basically a web app running in an Iframe.

• javascript
• security
• outlook-web-addins

Share Improve this question Follow edited Jan 29, 2016 at 16:41 Dmitry Streblechenko 66.5k44 gold badges5555 silver badges8383 bronze badges asked Jan 29, 2016 at 10:21 nforssnforss 1,25811 gold badge1717 silver badges3232 bronze badges 5

• Can you tell us more about the "third party" API. When you say "third party" I suppose that this not your web app that serves the add-in neither a Microsoft apis (EWS, outlook apis, office365 etc.), correct? How this api secure? Except if it supports only basic authentication, you could be able to retrieve some kind of token or authorization codes that you will have to keep which is far more secure than keeping raw credentials. – Benoit Patra Commented Jan 29, 2016 at 12:56
• You are right that "third party" is perhaps the wrong term. I am referring to our own web API, for which the Outlook add-in is being built. A way to access the service from within Outlook. – nforss Commented Jan 29, 2016 at 16:27
• And the API uses Basic authentication (over SSL). – nforss Commented Jan 29, 2016 at 16:28
• Did you manage to find a solution? – Benoit Patra Commented Feb 4, 2016 at 11:44
• I used HTML 5 local storage, as you suggested, and it seems to be working fine. I'll mark that response as the correct answer. Thank you! – nforss Commented Feb 7, 2016 at 17:04

Add a ment  | 

2 Answers 2

Sorted by: Reset to default 3

I assume you cannot implement another authorization scheme (token based, cookies etc.) for your API and you are stuck with Basic Authentication and its issues. If you are using ASP.NET, with all the samples available it could be very easy to add another authentication scheme that is more adapted to web clients (such as Office web add-ins).

Having said that, for me your best option is to use HTML5 storage or cookie storage (if not implemented by browser) to store your credentials.

The fact that the app is iFramed is not really a big deal. Those storages (HTML5: sessionStorage/localStorage) rely on domains separation which means that the storage slots where you will put the credentials will not be be visible by other apps, even those living on the parent iFrame.

You may also consider the fact that you may serve the web add-ins and the apis from the same domain. They are both web applications!

You can do what Outlook itself does for its POP3/SMTP/IMAP4 passwords - use CredRead / CredWrite Windows API functions. The data can only be decrypted under the local Windows account used to encrypt the data, so it cannot be take to a different machine and decrypted.

I don't think you can access these functions from JavaScript. This is for an OWA addin, not the Outlook application, is it?

本文标签： javascriptHow to store credentials in an Outlook AddinStack Overflow